skills.rest
KSD-CO
KSD-COOFFICIAL
Explore all skills by this author →
GitHub

security-review

Identify security vulnerabilities in the current branch diff and write findings to SECURITY-REVIEW.md.

11|1|Updated Feb 7, 2026
Search Tags:#security#vulnerability#reporting#diff#static-analysis#code-review#semgrep
One-click install
npx skills add https://github.com/KSD-CO/IronCode --skill security-review-ksd-co
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/KSD-CO/IronCode/tree/main/packages/ironcode/skills/security-review
Command: npx skills add https://github.com/KSD-CO/IronCode --skill security-review-ksd-co

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security review of code diffs to identify vulnerabilities before shipping, without modifying source code.

Core Features & Use Cases

  • Scans diffs for security issues against OWASP-like patterns
  • Integrates Semgrep MCP when available and merges findings into the report
  • Writes a SECURITY-REVIEW.md with both manual and Semgrep findings

Quick Start

Trigger the security-review workflow to generate SECURITY-REVIEW.md for the current branch without modifying source files.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate security review of code diffs before shipping?▼

To scan code diffs for security vulnerabilities, trigger the workflow to evaluate branch changes against OWASP-like risk patterns. It generates a SECURITY-REVIEW.md report detailing findings without modifying your source files.

Does this security review tool support Python, Go, and JavaScript backends?▼

Yes, the security review tool supports JavaScript, TypeScript, Python, Java, and Go backends. It applies language-specific checks to evaluate code changes against standard risk patterns.

How do I integrate Semgrep static analysis into my code review workflow?▼

Integrate Semgrep static analysis into your code review workflow via optional MCP integration. The tool merges Semgrep findings with manual checklist results into a comprehensive SECURITY-REVIEW.md report.

What is the best way to generate a security vulnerability report for a branch diff?▼

The best way to generate a security vulnerability report for a branch diff is using a two-pass review workflow. It evaluates changes against standard risk patterns and outputs a comprehensive SECURITY-REVIEW.md file.

Can I run a security code review without modifying my source files?▼

Yes, you can run a security code review without modifying source files. The workflow preserves source integrity by writing all vulnerability findings and manual checks exclusively to a SECURITY-REVIEW.md report.

What happens if Semgrep MCP is not available during a diff security review?▼

If Semgrep MCP is not available during a diff security review, the workflow falls back to a manual checklist. It still evaluates code changes against standard risk patterns and writes findings to SECURITY-REVIEW.md.

Related Skills

Explore More Software Engineering Skills→
wzh4464wzh4464
3

detect-vulnerability

Identify security vulnerabilities in git diffs using a multi-agent analysis pipeline.

Community
Advanced
Logisoft-webLogisoft-web

vulnerability-scanner

Scan code repositories for vulnerabilities in dependencies, secrets, and configurations.

Community
Advanced
macaughmacaugh
5

Static Vulnerability Analysis

Detects injection, memory safety and authorization flaws in multiple languages.

Community
Advanced
lamb92009lamb92009

security-reviewer

Identify vulnerabilities in code, configurations, and infrastructure with prioritized remediation guidance.

Community
Advanced