security-review - SKILL.md Agent Skill

name: security-review description: >- Request a security expert assessment for code changes that touch child process spawning, file system access, configuration loading, or environment variable handling. Use when the Reviewer identifies security-sensitive changes in the MCP-LSP bridge. compatibility: Designed for Claude Code (or similar products) metadata: author: ktnyt version: "1.0"

Security Review

Invoke the security-reviewer agent to assess security-sensitive changes.

When to trigger

Child process spawning or lifecycle changes (src/lsp-client.ts)
File system read/write operations (src/file-editor.ts, src/file-scanner.ts)
Configuration file loading or parsing (cclsp.json, CCLSP_CONFIG_PATH)
Environment variable handling
New or modified LSP server adapter (src/lsp/adapters/)
Setup wizard input handling (src/setup.ts)

Review checklist

Command injection: Are user-supplied values (config file paths, server commands) sanitized before being passed to child_process spawn?
Path traversal: Can file paths from LSP responses escape the project root? Are file:// URIs validated before resolving?
Resource exhaustion: Are there timeouts on LSP server responses? Can a malicious LSP server cause unbounded memory growth?
Config trust boundary: Is cclsp.json treated as trusted input? What happens if it contains unexpected fields or types?
Process cleanup: Are child processes reliably terminated on shutdown? Can orphaned processes persist?
Symlink attacks: Does file resolution follow symlinks outside the project directory?

How to invoke

Use the everything-claude-code:security-reviewer agent via the Task tool:

Task(
  subagent_type: "everything-claude-code:security-reviewer",
  prompt: "Review the following changes for security concerns: <describe changes>"
)

Output expectations

The security reviewer should produce:

CRITICAL: Must fix before merge (injection, traversal, credential leak)
HIGH: Should fix before merge (missing timeouts, incomplete cleanup)
MEDIUM: Fix when possible (defensive checks, hardening opportunities)
LOW: Informational (best practice suggestions)