git log --oneline --stat
HEAD
- Stars
- 6.8k
- Forks
- 407
- Updated
- May 27, 2026
repo --stat
stars
6.8k
forks
407
last update
May 27, 2026
license
MITv2.4.0
quickstart.sh
3 steps
- Install
// Drops SKILL.md into ~/.claude/skills/
$ claude skills add security-review-skill - Invoke
// Run from any project directory
$ claude --skill security-review-skill "wire up a GitHub Actions deploy" - Iterate
// Re-run with edits — Claude keeps the skill loaded
$ claude --skill security-review-skill "now refactor it"
security-review-skill/
references
- references/
- SKILL.mdopen
- README.mdopen
SKILL.md
readonly
- name:
- Security Review
- slug:
- security-review-skill
- version:
- v2.4.0
- license:
- MIT
- author:
- @anthropic-labs
- categories:
- tags:
- #security#owasp#code-review#audit#saas-security
- description:
OWASP-aware code security audit — finds auth, input, secret, and dependency issues with remediation.
features.md
5 capabilities
// What you can do with it
- Access control — missing authorization checks, IDOR, routes that trust client-supplied IDs or roles.
- Injection — string-built SQL/NoSQL/shell/LDAP queries, unescaped template output, unsafe deserialization.
- Secrets — hardcoded API keys, tokens, private keys, and connection strings introduced in the diff.
- Input validation — unbounded input, missing allow-lists, SSRF-prone URL fetches, path traversal.
- Dependencies — new or bumped packages in package.json, requirements.txt, go.mod, etc., cross-checked for known CVEs.
README.md
security-review-skill/README.md
8 sections
Loading README…
$ cat reviews/
Reviews
// No reviews yet. Be the first.
Loading review form…