API security review

Use this skill before committing or reviewing any change to an HTTP API that touches routing, auth middleware, settings or config endpoints, logging and telemetry, SQL, error handling, response shaping, client IP, rate limits or an outbound fetch — and whenever the user asks for a security review, an audit, or says an endpoint "seems public", "returns too much" or "leaks something": it runs ten checks with ready grep pre-screens (auth on every mutating route, ownership from the authenticated id, no secrets or PII in responses, bound SQL, fail-safe env gates, resource caps, redacted logs, downstream injection, no trust from caller input, supply chain) and blocks the commit…