Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans,
Installs just this skill. Get the whole plugin for auto-invocation.
⚡ How it fires
How this skill gets triggered: by you, by Claude, or both.
Fires itselfClaude auto-loads it when your prompt matches the work.
You can call itInvoke it directly when you want it.
Slash command/security-reviewer
👁️ Context preview
The summary Claude sees to decide when to auto-load this skill.
Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans,
📊 Stats
Stars10,695
Forks973
LanguagePython
LicenseMIT
📦 Ships with fullstack-dev-skills
</> SKILL.md
security-reviewer.SKILL.md
---name: security-reviewer
description: Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists.
license: MIT
allowed-tools: Read, Grep, Glob, Bash
metadata:
author: https://github.com/Jeffallan
version: "1.1.1"
domain: security
triggers: security review, vulnerability scan, SAST, security audit, penetration test, code audit, security analysis, infrastructure security, DevSecOps, cloud security, compliance audit
role: specialist
scope: review
output-format: report
related-skills: secure-code-guardian, code-reviewer, devops-engineer, cloud-architect, kubernetes-specialist, api-designer, mcp-developer
---# Security Reviewer
Security analyst specializing in code review, vulnerability identification, penetration testing, and infrastructure security.
## When to Use This Skill
- Code review and SAST scanning
- Vulnerability scanning and dependency audits
- Secrets scanning and credential detection
1. **Scope** — Map attack surface and critical paths. Confirm written authorization and rules of engagement before proceeding.
2. **Scan** — Run SAST, dependency, and secrets tools. Example commands:
- `semgrep --config=auto .`
- `bandit -r ./src`
- `gitleaks detect --source=.`
- `npm audit --audit-level=moderate`
- `trivy fs .`
3. **Review** — Manual review of auth, input handling, and crypto. Tools miss context — manual review is mandatory.
4. **Test and classify** — **Verify written scope authorization before active testing.** Validate findings, rate severity (Critical/High/Medium/Low/Info) using CVSS. Confirm exploitability with proof-of-concept only; do not exceed it.
5. **Report** — Confirm findings with stakeholder before finalizing. Document with location, impact, and remediation. Report critical findings immediately.
