skills.rest
sarkarshivaditya-lab
sarkarshivaditya-labCOMMUNITY
Explore all skills by this author →
GitHub

security-review

Reviews security-sensitive code changes against the OWASP Top 10 checklist.

Updated Jan 1, 2026
Search Tags:#code review#pull request#authentication#vulnerability#owasp#security review#dependency audit
One-click install
npx skills add https://github.com/sarkarshivaditya-lab/WellMate --skill security-review-sarkarshivaditya-lab
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/sarkarshivaditya-lab/WellMate/tree/main/.engineering-skills/troykelly-claude-skills/skills/security-review
Command: npx skills add https://github.com/sarkarshivaditya-lab/WellMate --skill security-review-sarkarshivaditya-lab

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Code touching authentication, APIs, databases, or credentials needs deeper scrutiny than a general code review, and vulnerabilities like SQL injection or hardcoded secrets are easy to miss without a structured checklist. ## Core Features & Use Cases - OWASP Top 10 Checklist: Systematically reviews injection, broken authentication, sensitive data exposure, access control, XSS, and other vulnerability categories. - Automatic Trigger Detection: Identifies security-sensitive changes by matching modified files against patterns like auth, middleware, routes, tokens, and SQL migrations. - Severity-Rated Findings: Classifies issues as CRITICAL, HIGH, MEDIUM, or LOW with clear merge-blocking rules, plus dependency audits via pnpm audit or pip-audit. - Use Case: Before merging a pull request that modifies login and session middleware, run this review to verify password hashing, cookie flags, rate limiting, and access control, then document findings in a structured security review artifact. ## Quick Start Ask the AI to perform a security review of the current branch's changes to authentication and API files before creating the pull request.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review code for OWASP Top 10 vulnerabilities?▼

Review each changed file against all ten OWASP categories including injection, broken authentication, sensitive data exposure, and broken access control. Document each finding with a severity level and verify fixes for CRITICAL and HIGH issues before merging.

When is a security review required before a pull request?▼

A security review is mandatory when changes touch files matching patterns like auth, security, middleware, api, password, token, secret, credential, session, routes, or SQL migrations. You can detect these with git diff filtered through a grep pattern.

How do I check for hardcoded secrets in source code?▼

Search the codebase with a grep pattern matching assignments to password, secret, api_key, or token variables with quoted string values. Any hardcoded credentials found must be moved to environment variables or a secrets manager before merge.

Does this security review check dependencies for vulnerabilities?▼

Yes, the review process includes running pnpm audit or pip-audit to detect known CVEs in dependencies, along with checking for critically outdated packages. Audit results are recorded in the security review artifact.

What severity levels are used for security findings?▼

Findings are classified as CRITICAL, HIGH, MEDIUM, or LOW. CRITICAL and HIGH issues must be fixed before merge, MEDIUM issues should be fixed, and LOW issues may be deferred to a future tracking issue.

Related Skills

Explore More Software Engineering Skills→
AradotsoAradotso
4

stage-cli-code-review

Organize local git diffs into logical chapters for code review.

Official
Intermediate
korchasakorchasa

agent-tech-lead-review

Automate final pull request review and merge in an SDLC pipeline.

Community
Advanced
ql-linkql-link
5

code-review-and-quality

Automate code quality reviews across five dimensions with prioritized feedback.

Official
Advanced
xlelibertyxleliberty

security-pen-testing

Perform offensive security assessments with vulnerability scanning and penetration testing.

Community
Advanced