my-security-review-checklistlisted

# My Security Review Checklist ## Overview A tight, runnable security gate for the kind of code in this ecosystem: **agent skills, subagents, slash commands, hooks, shell and sync scripts, dotfiles, and plugin/MCP configuration.** This is not web-app security - for that, use `agent-skills:security-and-hardening`. This checklist exists because agent tooling has its own attack surface: arbitrary command execution via hooks, untrusted LLM/agent output flowing into actions, secrets sitting in config files, and destructive file operations on a synced source of truth. Run it **before merge, not after.** The review is the gate. ## When to Use - Before committing or merging any change to a **skill, subagent, command, or hook** - Before editing **`settings.json` / `settings.local.json`** (permissions, env, hooks) - Before changing a **shell or sync script** (`sync-skills.sh`, anything with `mv`/`rm`/`ln`) - Before **installing, updating, or trusting a plugin or MCP server** - Whenever code will **consume untrusted input** - agent inbox messages, web/MCP responses, file contents, command output ## The Checklist Findings are labelled **Critical** (blocks merge), **Important** (fix before merge), or **Suggestion** (optional). Treat anything touching secrets, command execution, or destructive file ops as Critical until proven otherwise. ### 1. Secrets & dotfiles - [ ] No secrets (API keys, tokens, passwords) in any committed file - skills, hooks, scripts, configs - [ ] `.gitignor