security-review

Trace data flow to identify exploitable security vulnerabilities in source code.

5|Updated Jan 20, 2026
One-click install
npx skills add https://github.com/mohamedgshoaib/reway --skill security-review-mohamedgshoaib
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/mohamedgshoaib/reway/tree/main/.agents/skills/security-review
Command: npx skills add https://github.com/mohamedgshoaib/reway --skill security-review-mohamedgshoaib

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill addresses the challenge of identifying exploitable security vulnerabilities in codebases by providing a structured, context-aware audit process that filters out theoretical noise and focuses on high-confidence, attacker-controlled patterns.

Core Features & Use Cases

  • Context-Aware Auditing: Automatically loads relevant security references (e.g., injection, XSS, auth) based on the code type being reviewed.
  • Confidence-Based Reporting: Distinguishes between high-confidence exploitable patterns and theoretical issues, ensuring actionable results.
  • Use Case: Use this during a pull request review to identify potential SQL injection or hardcoded secrets in a new API endpoint, ensuring only verified vulnerabilities are flagged for remediation.

Quick Start

Use the security-review skill to audit the provided file for potential authentication and authorization vulnerabilities.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I identify exploitable security vulnerabilities in source code?▼

Security auditing for injection flaws works by tracing data flow from attacker-controlled inputs to verify high-confidence risks. This context-aware process filters theoretical noise by analyzing framework-specific protections and server-side configurations.

Can I use automated code review to detect SQL injection and hardcoded secrets?▼

Automated code review detects SQL injection and hardcoded secrets by tracing attacker-controlled inputs to verify exploitable patterns. It applies context-aware analysis to distinguish high-confidence vulnerabilities from theoretical issues.

Does this security audit work across various programming languages and infrastructure configurations?▼

Security auditing applies across various programming languages and infrastructure configurations. It systematically analyzes framework-specific protections and server-side configurations to verify vulnerabilities regardless of the underlying tech stack.

What is the best way to perform a high-confidence security audit during a pull request?▼

High-confidence security auditing during a pull request requires tracing data flow and verifying attacker-controlled inputs. This context-aware approach filters theoretical noise, ensuring only verified vulnerabilities are flagged for remediation.

How does confidence-based reporting filter out theoretical vulnerabilities in a security review?▼

Confidence-based reporting filters theoretical vulnerabilities by verifying attacker-controlled inputs and tracing data flow. It distinguishes between high-confidence exploitable patterns and theoretical issues to ensure only actionable results are reported.

When should I not use a systematic security audit for vulnerability assessment?▼

Avoid systematic security auditing if you only need a quick syntax check or lack access to server-side configurations. High-confidence vulnerability assessment requires analyzing framework-specific protections and tracing data flow, which needs full context.