skills.rest
Fidasek009
Fidasek009COMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-review

Review code for exploitable security vulnerabilities with confidence-based reporting.

1|Updated Dec 30, 2025
Search Tags:#code analysis#xss#owasp#injection#security review#code audit#vulnerability detection
One-click install
npx skills add https://github.com/Fidasek009/agents --skill security-review-fidasek009
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/Fidasek009/agents/tree/main/.agents/skills/security-review
Command: npx skills add https://github.com/Fidasek009/agents --skill security-review-fidasek009

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Manual security code reviews often drown teams in false positives and theoretical issues, making it hard to find genuinely exploitable vulnerabilities before attackers do. ## Core Features & Use Cases - Confidence-Based Reporting: Reports only HIGH confidence findings where attacker-controlled input is confirmed, separating verified vulnerabilities from theoretical concerns. - Framework-Aware Analysis: Distinguishes attacker-controlled input from server-controlled configuration and accounts for framework protections like ORM parameterization and React auto-escaping. - Comprehensive Coverage: Includes 17 reference guides covering injection, XSS, authentication, authorization, cryptography, SSRF, CSRF, deserialization, business logic, and more, based on the OWASP Cheat Sheet Series. - Use Case: Before merging a pull request that adds a new API endpoint, ask for a security review to trace data flow, verify exploitability, and receive a structured report with severity ratings and remediation guidance. ## Quick Start Ask the AI to perform a security review of the current file or diff to find exploitable vulnerabilities.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review code for security vulnerabilities?▼

Request a security review of a specific file, diff, or component. The review traces data flow to confirm attacker-controlled input, checks framework protections, and reports only high-confidence exploitable findings with severity ratings and fixes.

What vulnerabilities does a security code review detect?▼

It covers SQL and command injection, XSS, CSRF, SSRF, authentication and authorization flaws, IDOR, insecure deserialization, weak cryptography, hardcoded secrets, path traversal, mass assignment, and business logic errors like race conditions.

How does the review avoid false positives?▼

It distinguishes attacker-controlled input from server-controlled configuration like environment variables and settings, and accounts for framework mitigations such as ORM parameterization and React auto-escaping before flagging any issue.

Does the security review work with frameworks like Django and React?▼

Yes. The review checks framework-specific protections, such as Django ORM query parameterization and React's default output escaping, and only flags patterns like raw SQL or dangerouslySetInnerHTML when user input is actually involved.

What severity levels are used in security review findings?▼

Findings are classified as Critical, High, Medium, or Low based on exploitability and impact. Critical covers issues like RCE and SQL injection, while Low covers defense-in-depth concerns like missing headers.

Related Skills

Explore More Software Engineering Skills→
fatihkanfatihkan
7

sc-recon

Detect codebase architecture and technology stack for security analysis.

Community
Advanced
nexus-substratenexus-substrate
18

security-scanning

Triage CodeQL and secret scanning alerts, fix findings, and classify secrets.

Official
Advanced
BryantChiBryantChi
9

Supply Chain Security

Implement dependency governance and integrate SCA scans into CI pipelines.

Community
Advanced
rnavarychrnavarych
14

role-aqa:security-testing

Your response is missing. Please try again.

Community
Advanced