Security Review

Security Review runs a structured, OWASP-aware audit over your uncommitted changes and flags the vulnerabilities a human reviewer tends to miss under deadline: broken access control, injection, leaked secrets, and known-vulnerable dependencies. It reads the actual diff rather than scanning the whole tree, so feedback stays scoped to what you're about to ship. Built for backend and full-stack engineers, QA, and anyone who owns the review gate on a SaaS codebase.

When to use it

• Right before opening or merging a PR, as a self-review pass on the branch diff.
• After adding an auth flow, a new API route, a file upload, or a raw SQL query.
• When you pull in a new dependency and want a quick CVE sanity check.
• During incident hardening, to sweep recently touched code for the same class of bug.

What it does

The skill collects the working diff (staged and unstaged against the branch base) and reviews each changed hunk against a security checklist derived from the OWASP Top 10:

• Access control — missing authorization checks, IDOR, routes that trust client-supplied IDs or roles.
• Injection — string-built SQL/NoSQL/shell/LDAP queries, unescaped template output, unsafe deserialization.
• Secrets — hardcoded API keys, tokens, private keys, and connection strings introduced in the diff.
• Input validation — unbounded input, missing allow-lists, SSRF-prone URL fetches, path traversal.
• Dependencies — new or bumped packages in package.json, requirements.txt, go.mod, etc., cross-checked for known CVEs.

Each finding is ranked Critical / High / Medium / Low, cites the file and line, explains the exploit path, and includes a concrete fix — usually a corrected code snippet, not just advice.

Usage

# install once
curl -fsSL --create-dirs -o ~/.claude/skills/security-review-skill/SKILL.md https://claudeskil.com/skills/security-review-skill/SKILL.md

# stage your work, then run the review on the current branch
git add -A
/security-review

Output is a severity-ordered report, for example:

HIGH  src/api/orders.ts:42  Broken access control (IDOR)
  Order is fetched by req.params.id with no ownership check.
  Fix: if (order.userId !== req.user.id) return res.status(403)...

Tips & gotchas

• It reviews the diff, not the whole repo — pre-existing issues in untouched files won't surface. Run it on the branch where the code was introduced.
• Stage or commit your changes first; an empty diff yields an empty report.
• Dependency CVE matching reflects the model's knowledge cutoff. Treat it as a first pass and keep npm audit / pip-audit in CI for authoritative results.
• Severity is contextual, not absolute — a "High" in an internal tool may be lower risk than in a public endpoint. Use it to triage, not to gate blindly.

FAQ

Does this replace SAST tools like Snyk or CodeQL? No. It's a fast, context-aware review at code-write time. Keep your scanners in CI for coverage and compliance.

Can it review an entire codebase? It's optimized for diffs. For a full audit, review module by module rather than one giant pass.

Will it modify my code? No. It only reports findings and suggested fixes; you apply the changes.