security-review ECC Skill Review: A Useful Checklist With Stale Defaults

security-review in affaan-m/ECC is a 12,493-byte SKILL.md backed by a 10,171-byte cloud-infrastructure note. That is the concrete part. The less comfortable part is this: the skill is sensible, but the surrounding ECC ecosystem has enough security-related issue history that you should treat it as a checklist, not a shield.

What the skill actually says

The activation rules are broad but reasonable. The skill asks to load when the agent is doing authentication, user input, file uploads, API endpoints, secrets, payments, sensitive data, or third-party integrations. In other words: most real web work.

Three short lines from skills/security-review/SKILL.md capture the center of gravity:

The file then walks through common web-app failure classes: secrets, input validation, SQL injection, auth, XSS, CSRF, rate limiting, sensitive logging, Solana wallet checks, dependency safety, and deployment review. The companion cloud-infrastructure-security.md expands the same idea into IAM, cloud secrets, network access, logging, CI/CD, Terraform, database security, backups, and incident response.

The good news: there is no magic. It is mostly a plain checklist with safe and unsafe examples. That makes it easy to audit and easy to transplant into another harness. The bad news: there is also no magic. It will not prove a patch is safe. It can remind an agent to look for SQL concatenation, localStorage tokens, weak CSP, and missing rate limits, but the quality of the finding still depends on the model reading the right files and understanding the app.

What it costs you in context

We did not run this skill through our API. These numbers are only file-size arithmetic from the source tree inspected on August 28, 2026. The estimate is intentionally simple: bytes ÷ 4 ≈ context tokens. That is not a tokenizer measurement, and it is not a bill. It is a repeatable proxy for the amount of text the skill can add to a session.

About 5.7k estimated tokens is not tiny, but it is acceptable for a security-sensitive change. I would not keep it loaded while renaming a CSS class. I would load it before touching auth middleware, webhook signature validation, file uploads, payment flows, multi-tenant data access, or anything that writes secrets to logs.

What the community reports

Public discussion of the specific security-review skill is thin. Hacker News Algolia returned no direct threads for the skill or the repo. GitHub is the useful source here, and the strongest signals are not applause; they are bug reports and security reviews around ECC’s agent harness.

That evidence cuts both ways. On the positive side, ECC has a large user surface and maintainers respond to concrete security reports. Several issues were accepted, fixed, or closed with specific remediation notes. On the negative side, the reports are not theoretical. They involve installer policy, local dashboards, hook enforcement, reviewer tool scope, and malicious clones. Those are exactly the surfaces you care about when installing an agent framework that can read and write project files.

How to install it

The current README says the simplest Claude Code path is the native plugin install:

/plugin marketplace add https://github.com/affaan-m/ECC
/plugin install ecc@ecc

If you only want this skill and a smaller install surface, the README also documents explicit component installs after cloning the repo:

git clone https://github.com/affaan-m/ECC.git
cd ECC
./install.sh --target claude --skills tdd-workflow,security-review

It also recommends previewing matching components first:

node scripts/ecc.js consult "security reviews" --target claude

My recommendation: do not install the full surface casually. Start with the plugin if you want ECC as a system. Start with explicit skills if you only want review checklists. The README itself warns not to stack install methods, because duplicate installs can duplicate skills, commands, hooks, or config.

Where it earns its keep

This skill earns its place when a feature creates blast radius: auth, permissions, tenant boundaries, file uploads, payments, webhooks, secret handling, cloud deploys, or CI/CD. It is especially useful as a pre-merge second pass. Ask the agent to review the diff against this skill, then force it to cite files and lines for every finding. A checklist like this is good at preventing blank spots.

It is weaker as an always-on coding companion. The advice is broad and mostly introductory. Some examples are stack-specific: Zod, Supabase, Express, Next.js, Solana, AWS. If your project is Rails, Django, Go, Laravel, or a mature internal platform, the skill may spend context on examples that do not match your codebase. The CSP example also needs care: the root file explicitly warns that 'unsafe-inline' and 'unsafe-eval' weaken CSP, but the sample header still includes them as a compatibility example. A rushed agent could copy the sample instead of the warning.

Verdict

security-review is worth using, but not because it is deep. It is worth using because agents skip boring checks when they are racing to implement. This skill slows them down in the right places: secrets, auth, validation, authorization, logging, dependencies, and deploy settings.

The criticism is simple: it is a broad checklist inside a broad framework, and the broader framework has had real security and install-surface bugs reported by users. That does not make the skill bad. It means the safest way to use it is narrow: load the checklist for security-sensitive work, keep the install surface small, and treat every agent finding as a lead to verify, not a verdict to ship.

FAQ

Does this review include measured token or dollar cost?

No. We did not run the skill through any API. The context numbers are estimates from source file size using bytes divided by four.

Is there public community discussion of this exact skill?

Very little. The useful public evidence is GitHub issue history around ECC’s security posture, installer behavior, hooks, and review-agent permissions.

Should I install all of ECC just to get this skill?

Probably not. If you only want a security checklist, use the explicit --skills security-review path after cloning, or inspect the markdown and adapt it to your own harness.

What is the strongest criticism?

The skill is more checklist than expert auditor. It can make an agent look in the right places, but it will not replace threat modeling, dependency review, or a human security review for high-risk systems.

Attribution: security-review is from affaan-m/ECC, authored by Affaan Mustafa and contributors, licensed under MIT. Review date: August 28, 2026. Community reception shifts over time; check the issue tracker before making install decisions.