What problem does it solve? Security weaknesses in code changes and third-party dependencies often slip into production because reviews are ad-hoc and untraceable. This Skill provides a structured, standards-based security review process that produces severity-classified, evidence-linked findings that flow into defect management. ## Core Features & Use Cases - Secure Code Review: Inspect implementation changes for injection flaws, broken access control, authentication defects, insecure deserialisation, and sensitive-data exposure against OWASP Top 10, ASVS, and Proactive Controls. - Dependency Vulnerability Assessment: Check dependency manifests and lockfiles against known-vulnerability sources, flagging vulnerable, abandoned, or licence-incompatible components. - Risk Triage and Routing: Classify confirmed findings by severity, gate critical issues before merge, and record accepted-risk decisions in a decision log. - Use Case: Before merging a pull request that touches authentication logic, run this Skill to review the diff against OWASP controls, assess the updated dependency manifest, and route confirmed findings to defect management with full evidence. ## Quick Start Ask the AI to perform a Forge security review of the current code changes and dependency manifest against the OWASP standards and produce severity-classified findings.
