My Security Review Checklist

Personal pre-merge security gate for agent tooling - skills, subagents, slash commands, hooks, shell/sync scripts, dotfiles, settings.json, and plugin/MCP trust. Also scans for user-specific absolute paths, device/vault overfitting, and hardcoded personal constants (names, emails, handles, personal repo URLs, vault/project names) in shared tooling - anything the agent should instead infer at runtime or ask for live - and can fix them (prefer ~/ on macOS). Scans any file an agent reads as instructions for text hidden from the human reviewer - invisible Unicode, ASCII/tag smuggling, zero-width characters, bidi overrides - so use it whenever asked whether a skill, prompt, rules file, or pasted content has hidden or invisible instructions in it. MUST be used before committing or merging any change to ~/.agents or ~/.claude, before keeping or enabling a new or changed hook (PreToolUse/PostToolUse/SessionStart in settings.json - "review this hook", "check my hook before I keep it"), before installing or trusting a plugin or MCP server, and for any automation that runs commands, touches files, or consumes untrusted agent/LLM/web/MCP output - apply this checklist rather than reviewing ad hoc.

mkdir -p ~/.claude/skills/my-security-review-checklist
curl -L https://claudskills.com/skills/my-security-review-checklist/SKILL.md \
  -o ~/.claude/skills/my-security-review-checklist/SKILL.md

@misc{my-security-review-checklist-2026,
  author    = {anton-winter-arch},
  title     = {My Security Review Checklist [Claude Code skill]},
  year      = {2026},
  publisher = {ClaudSkills},
  url       = {https://claudskills.com/skills/my-security-review-checklist/}
}