skilld
All skills
jeffallan avatar

/security-reviewer

@efebc44
by jeffallanjeffallan/claude-skills12k stars
1,124

Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists.

Ask your Agent

Use this Skill: https://skilld.dev/gh/jeffallan/claude-skills/security-reviewer

This session only. Nothing lands on disk.

referencessecret-scanning.md

≈744 tokens on demand. Your agent reads this file only when SKILL.md points to it.

Secret Scanning

Gitleaks

# Install
brew install gitleaks

# Scan current directory
gitleaks detect --source . --verbose

# Scan with report
gitleaks detect --source . -f json -r gitleaks-report.json

# Scan git history
gitleaks detect --source . --log-opts="--all"

# Use baseline (ignore known)
gitleaks detect --baseline-path .gitleaks-baseline.json

TruffleHog

# Install
pip install trufflehog

# Scan filesystem
trufflehog filesystem .

# Scan git repo
trufflehog git file://. --since-commit HEAD~100

# Scan with JSON output
trufflehog filesystem . --json > trufflehog-report.json

Manual Grep Patterns

# Common secret patterns
grep -rn "api_key\|apikey\|api-key" --include="*.{ts,js,py}" .
grep -rn "secret\|password\|passwd" --include="*.{ts,js,py}" .
grep -rn "private_key\|privatekey" --include="*.{ts,js,py}" .
grep -rn "access_token\|accesstoken" --include="*.{ts,js,py}" .

# AWS credentials
grep -rn "AKIA[0-9A-Z]{16}" .
grep -rn "aws_secret_access_key" .

# Base64 encoded (potential secrets)
grep -rn "[A-Za-z0-9+/]{40,}=" .

# JWT tokens
grep -rn "eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\." .

Common Secret Patterns

Type Pattern Example
AWS Access Key AKIA[0-9A-Z]{16} AKIAIOSFODNN7EXAMPLE
AWS Secret Key 40 char base64 wJalrXUtnFEMI/K7MDENG...
GitHub Token ghp_[A-Za-z0-9]{36} ghp_xxxxxxxxxxxx
Slack Token xox[baprs]- xoxb-xxx-xxx
Stripe Key sk_live_[A-Za-z0-9]{24} sk_live_xxxx
Private Key -----BEGIN.*PRIVATE KEY----- RSA/EC keys
JWT eyJ[A-Za-z0-9_-]*\.eyJ Encoded tokens

Pre-commit Hook

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.0
    hooks:
      - id: gitleaks

CI/CD Integration

# GitHub Actions
- name: Gitleaks
  uses: gitleaks/gitleaks-action@v2
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

# GitLab CI
secret_detection:
  image: zricethezav/gitleaks
  script:
    - gitleaks detect --source . -f sarif -r gl-secret-detection-report.sarif
  artifacts:
    reports:
      secret_detection: gl-secret-detection-report.sarif

Remediation Steps

  1. Rotate immediately - Consider secret compromised
  2. Remove from history - Use git filter-branch or BFG
  3. Add to .gitignore - Prevent future commits
  4. Use env variables - Move to environment
  5. Use secret manager - AWS Secrets Manager, Vault
# Remove from git history (BFG)
bfg --replace-text passwords.txt repo.git

# Or git filter-branch
git filter-branch --force --index-filter \
  "git rm --cached --ignore-unmatch path/to/secret" \
  --prune-empty --tag-name-filter cat -- --all

Quick Reference

Tool Best For Speed
Gitleaks Git history Fast
TruffleHog Deep scanning Medium
grep Quick checks Fast
GitHub Secret Scanning GitHub repos Auto

Source: SKILL.md on GitHub

Third-party checks

2 alerts16d5 checks · Risk CRITICAL
  • Gen Agent Trust Hub16d

    This skill provides a comprehensive framework for security auditing and penetration testing. It includes instructions for identifying vulnerabilities, scanning for secrets, and evaluating privilege escalation paths. While it contains commands for sensitive actions such as credential harvesting and local enumeration, these are documented within a professional audit context requiring explicit authorization and rules of engagement.

  • Socket16d

    1 alert: gptAnomaly

  • Snyk16d

    Risk: LOW · No issues

  • Runlayer6mo

    5/7 files flagged

  • ZeroLeaks5mo

    Score: 93/100 · 2 sections analyzed

Provenance

Signed by skilld at efebc44. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub 2 months ago.

Steadyupdated 5 months ago

Capability

What it can do
Reads files Runs commands
All 4 allowed tools
ReadGrepGlobBash
Other metadata
metadata
{
  "author": "https://github.com/Jeffallan",
  "version": "1.1.1",
  "domain": "security",
  "triggers": "security review, vulnerability scan, SAST, security audit, penetration test, code audit, security analysis, infrastructure security, DevSecOps, cloud security, compliance audit",
  "role": "specialist",
  "scope": "review",
  "output-format": "report",
  "related-skills": "secure-code-guardian, code-reviewer, devops-engineer, cloud-architect, kubernetes-specialist, api-designer, mcp-developer"
}

Topics

  • Security
  • DevOps
  • vulnerability-scanning
  • sast
  • code-audit
  • penetration-testing
  • secrets-scanning
  • compliance
  • infrastructure-security
  • cvss

README badge

README badge for jeffallan/claude-skills/security-reviewer

What it does

Identifies code, infrastructure, and dependency vulnerabilities through SAST scanning, manual review, and penetration testing, then produces severity-rated audit reports with remediation guidance. Covers secrets scanning, cloud security, compliance checks, and DevSecOps workflows using tools like Semgrep, Bandit, Gitleaks, and Trivy.

Generated from the current SKILL.md.

Frequently asked

Does this skill perform active penetration testing or only static analysis?
It does both. The skill includes SAST scanning (semgrep, bandit), dependency audits, and secrets scanning, but also supports active penetration testing and reconnaissance. However, it requires written authorization and scope confirmation before any active testing.
What automated scanning tools does this skill use?
The skill runs semgrep, bandit, gitleaks, npm audit, and trivy. It treats automated tools as a starting point and requires manual review of auth, input handling, and crypto, since tools miss context-dependent vulnerabilities.
Does this skill generate compliance reports for SOC2 or ISO27001?
The skill produces structured vulnerability reports with severity ratings, findings with remediation guidance, and checklists. It references CIS benchmarks, SOC2, and ISO27001 in its knowledge base, but is designed primarily for vulnerability identification and audit support rather than compliance certification.
Can I use this skill to test production systems?
No. The skill explicitly requires written authorization and scope confirmation before active testing, and prohibits testing on production systems without explicit permission or causing service disruption or data loss.

Generated from the current SKILL.md. These answers refresh after source changes.