skills.rest
ArMaTeC
ArMaTeCCOMMUNITY
Explore all skills by this author →
GitHub

security-reviewer

Identifies code vulnerabilities and generates severity-rated security audit reports with remediation guidance.

Updated Mar 9, 2026
Search Tags:#owasp#penetration testing#security audit#vulnerability scan#sast#cvss#secret scanning
One-click install
npx skills add https://github.com/ArMaTeC/Redball --skill security-reviewer-armatec
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-reviewer
Source: https://github.com/ArMaTeC/Redball/tree/main/.devin/skills/security-reviewer
Command: npx skills add https://github.com/ArMaTeC/Redball --skill security-reviewer-armatec

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Security reviews require coordinating multiple scanning tools, manual code inspection, and consistent severity classification, which is time-consuming and error-prone when done ad hoc. This Skill provides a structured workflow for finding vulnerabilities, rating them with CVSS, and producing actionable audit reports. ## Core Features & Use Cases - Automated Scanning Orchestration: Runs SAST tools (Semgrep, Bandit, GoSec), dependency audits (npm audit, Safety), and secrets scanners (Gitleaks, TruffleHog) with ready-to-use commands. - Manual Vulnerability Review: Covers OWASP Top 10 patterns including SQL injection, XSS, IDOR, path traversal, and command injection with vulnerable vs. secure code examples. - Structured Reporting: Produces findings with severity ratings (Critical/High/Medium/Low), CVSS scores, file/line locations, and remediation steps using a standard report template. - Use Case: Before deploying a web application, run this Skill to scan the codebase for hardcoded secrets and injection flaws, then receive a prioritized findings report your team can act on sprint by sprint. ## Quick Start Review this repository for security vulnerabilities and generate a severity-rated audit report with remediation steps.

Frequently Asked Questions about security-reviewer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security audit on my codebase?▼

Start with automated SAST tools like Semgrep (--config=auto) and Bandit for Python, then run dependency checks with npm audit or Safety. Follow with manual review of authentication, input handling, and cryptography, since tools miss contextual flaws.

What tools scan for hardcoded secrets in git repositories?▼

Gitleaks and TruffleHog are the primary tools for secret scanning. Gitleaks is fast for git history scans, while TruffleHog performs deeper filesystem analysis. Both can integrate into pre-commit hooks and CI/CD pipelines.

How are vulnerability severity ratings calculated?▼

Findings are rated Critical, High, Medium, or Low using CVSS scoring: Critical is 9.0-10.0, High is 7.0-8.9, Medium is 4.0-6.9, and Low is 0.1-3.9. Ratings consider exploitability and impact, such as remote code execution versus missing security headers.

Can penetration testing be done on production systems?▼

Active testing on production requires explicit written authorization and defined rules of engagement. Testing must stay within scope, avoid service disruption, use proof-of-concept only without exploiting further, and report critical findings immediately.

What is the difference between SAST and manual code review?▼

SAST tools like Semgrep and Bandit automatically detect known vulnerability patterns but miss contextual issues. Manual review is mandatory for authentication logic, authorization checks, and cryptographic usage that automated tools cannot evaluate correctly.

How do I remove a leaked secret from git history?▼

Rotate the secret immediately since it must be considered compromised. Then remove it from history using BFG Repo-Cleaner or git filter-branch, add the file to .gitignore, and move secrets to environment variables or a manager like HashiCorp Vault.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

conducting-network-penetration-test

Conducts authorized network penetration tests using PTES methodology from reconnaissance through reporting.

Community
Advanced
miptah21miptah21
2

tech-debt-tracker

Scan codebases for technical debt and generate prioritized remediation plans.

Community
Intermediate
ancolemanancoleman
503

managing-vulnerabilities

Automate multi-layer security scanning and SBOM generation in CI/CD pipelines.

Community
Advanced
balsm-healthbalsm-health
2

implementing-cloud-security-posture-management

Automate continuous security posture monitoring across AWS, Azure, and GCP.

Official
Advanced