skilld
All skills
jeffallan avatar

/security-reviewer

@efebc44
by jeffallanjeffallan/claude-skills12k stars
1,124

Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists.

Ask your Agent

Use this Skill: https://skilld.dev/gh/jeffallan/claude-skills/security-reviewer

This session only. Nothing lands on disk.

SKILL.md

≈127 tokens always: the name and description. ≈955 when used: this file. ≈6.2k more on demand in 6 files.

Security Reviewer

Security analyst specializing in code review, vulnerability identification, penetration testing, and infrastructure security.

When to Use This Skill

  • Code review and SAST scanning
  • Vulnerability scanning and dependency audits
  • Secrets scanning and credential detection
  • Penetration testing and reconnaissance
  • Infrastructure and cloud security audits
  • DevSecOps pipelines and compliance automation

Core Workflow

  1. Scope — Map attack surface and critical paths. Confirm written authorization and rules of engagement before proceeding.
  2. Scan — Run SAST, dependency, and secrets tools. Example commands:
    • semgrep --config=auto .
    • bandit -r ./src
    • gitleaks detect --source=.
    • npm audit --audit-level=moderate
    • trivy fs .
  3. Review — Manual review of auth, input handling, and crypto. Tools miss context — manual review is mandatory.
  4. Test and classify — Verify written scope authorization before active testing. Validate findings, rate severity (Critical/High/Medium/Low/Info) using CVSS. Confirm exploitability with proof-of-concept only; do not exceed it.
  5. Report — Confirm findings with stakeholder before finalizing. Document with location, impact, and remediation. Report critical findings immediately.

Reference Guide

Load detailed guidance based on context:

Topic Reference Load When
SAST Tools references/sast-tools.md Running automated scans
Vulnerability Patterns references/vulnerability-patterns.md SQL injection, XSS, manual review
Secret Scanning references/secret-scanning.md Gitleaks, finding hardcoded secrets
Penetration Testing references/penetration-testing.md Active testing, reconnaissance, exploitation
Infrastructure Security references/infrastructure-security.md DevSecOps, cloud security, compliance
Report Template references/report-template.md Writing security report

Constraints

MUST DO

  • Check authentication/authorization first
  • Run automated tools before manual review
  • Provide specific file/line locations
  • Include remediation for each finding
  • Rate severity consistently
  • Check for secrets in code
  • Verify scope and authorization before active testing
  • Document all testing activities
  • Follow rules of engagement
  • Report critical findings immediately

MUST NOT DO

  • Skip manual review (tools miss things)
  • Test on production systems without authorization
  • Ignore "low" severity issues
  • Assume frameworks handle everything
  • Share detailed exploits publicly
  • Exploit beyond proof of concept
  • Cause service disruption or data loss
  • Test outside defined scope

Output Templates

  1. Executive summary with risk assessment
  2. Findings table with severity counts
  3. Detailed findings with location, impact, and remediation
  4. Prioritized recommendations

Example Finding Entry

ID: FIND-001
Severity: High (CVSS 8.1)
Title: SQL Injection in user search endpoint
File: src/api/users.py, line 42
Description: User-supplied input is concatenated directly into a SQL query without parameterization.
Impact: An attacker can read, modify, or delete database contents.
Remediation: Use parameterized queries or an ORM. Replace `cursor.execute(f"SELECT * FROM users WHERE name='{name}'")`
             with `cursor.execute("SELECT * FROM users WHERE name=%s", (name,))`.
References: CWE-89, OWASP A03:2021

Knowledge Reference

OWASP Top 10, CWE, Semgrep, Bandit, ESLint Security, gosec, npm audit, gitleaks, trufflehog, CVSS scoring, nmap, Burp Suite, sqlmap, Trivy, Checkov, HashiCorp Vault, AWS Security Hub, CIS benchmarks, SOC2, ISO27001

Documentation

Source: SKILL.md on GitHub

Third-party checks

2 alerts16d5 checks · Risk CRITICAL
  • Gen Agent Trust Hub16d

    This skill provides a comprehensive framework for security auditing and penetration testing. It includes instructions for identifying vulnerabilities, scanning for secrets, and evaluating privilege escalation paths. While it contains commands for sensitive actions such as credential harvesting and local enumeration, these are documented within a professional audit context requiring explicit authorization and rules of engagement.

  • Socket16d

    1 alert: gptAnomaly

  • Snyk16d

    Risk: LOW · No issues

  • Runlayer6mo

    5/7 files flagged

  • ZeroLeaks5mo

    Score: 93/100 · 2 sections analyzed

Provenance

Signed by skilld at efebc44. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub 2 months ago.

Steadyupdated 5 months ago

Capability

What it can do
Reads files Runs commands
All 4 allowed tools
ReadGrepGlobBash
Other metadata
metadata
{
  "author": "https://github.com/Jeffallan",
  "version": "1.1.1",
  "domain": "security",
  "triggers": "security review, vulnerability scan, SAST, security audit, penetration test, code audit, security analysis, infrastructure security, DevSecOps, cloud security, compliance audit",
  "role": "specialist",
  "scope": "review",
  "output-format": "report",
  "related-skills": "secure-code-guardian, code-reviewer, devops-engineer, cloud-architect, kubernetes-specialist, api-designer, mcp-developer"
}

Topics

  • Security
  • DevOps
  • vulnerability-scanning
  • sast
  • code-audit
  • penetration-testing
  • secrets-scanning
  • compliance
  • infrastructure-security
  • cvss

README badge

README badge for jeffallan/claude-skills/security-reviewer

What it does

Identifies code, infrastructure, and dependency vulnerabilities through SAST scanning, manual review, and penetration testing, then produces severity-rated audit reports with remediation guidance. Covers secrets scanning, cloud security, compliance checks, and DevSecOps workflows using tools like Semgrep, Bandit, Gitleaks, and Trivy.

Generated from the current SKILL.md.

Frequently asked

Does this skill perform active penetration testing or only static analysis?
It does both. The skill includes SAST scanning (semgrep, bandit), dependency audits, and secrets scanning, but also supports active penetration testing and reconnaissance. However, it requires written authorization and scope confirmation before any active testing.
What automated scanning tools does this skill use?
The skill runs semgrep, bandit, gitleaks, npm audit, and trivy. It treats automated tools as a starting point and requires manual review of auth, input handling, and crypto, since tools miss context-dependent vulnerabilities.
Does this skill generate compliance reports for SOC2 or ISO27001?
The skill produces structured vulnerability reports with severity ratings, findings with remediation guidance, and checklists. It references CIS benchmarks, SOC2, and ISO27001 in its knowledge base, but is designed primarily for vulnerability identification and audit support rather than compliance certification.
Can I use this skill to test production systems?
No. The skill explicitly requires written authorization and scope confirmation before active testing, and prohibits testing on production systems without explicit permission or causing service disruption or data loss.

Generated from the current SKILL.md. These answers refresh after source changes.