skills.rest
j4hr3n
j4hr3nCOMMUNITY
Explore all skills by this author →
GitHub

code-review-security

Automate security-focused code reviews mapped to OWASP Top 10 and ASVS.

Updated Mar 24, 2023
Search Tags:#security#owasp#vulnerabilities#code-review#pr-review#asvs
One-click install
npx skills add https://github.com/j4hr3n/dotfiles --skill code-review-security-j4hr3n
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: code-review-security
Source: https://github.com/j4hr3n/dotfiles/tree/main/configs/claude-code/skills/code-review-security
Command: npx skills add https://github.com/j4hr3n/dotfiles --skill code-review-security-j4hr3n

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security-focused code reviews require a disciplined, repeatable approach to identify vulnerabilities before code merges. This guidance maps checks to OWASP Top 10 and the ASVS framework, helping reviewers apply consistent criteria across languages and project types.

Core Features & Use Cases

  • Scope & Context — Establish language/framework, trust boundary (server/client/library/CLI), data sensitivity, and exposure.
  • Systematic Review by Vulnerability Class — Prioritized coverage of Injection, Authentication & Session, Authorization, Cryptography, Data Exposure, Misconfiguration, and Deserialization.
  • Framework-Specific Checks — Apply checks tailored to detected frameworks (React, Express, Django, Flask, Spring, Rails, Go).
  • Diff-Specific Analysis — Review changed lines in PRs to verify preservation of security controls.
  • Produce Findings — Cite file:line, show vulnerable snippet, explain attack scenario, and propose fixes with evidence.
  • References & Guidance — Align with OWASP Top 10, ASVS, OWASP Code Review Guide, and OWASP Cheat Sheets.

Quick Start

Run the security review workflow on the target pull request to initiate the assessment.

Frequently Asked Questions about code-review-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate security code reviews aligned with OWASP Top 10 and ASVS?▼

Automate security code reviews by running a structured workflow that maps vulnerability checks to OWASP Top 10 and ASVS, providing step-by-step analysis for injection, authentication, authorization, cryptography, and data exposure across your project.

Can I perform PR diff analysis to check for security vulnerabilities before merging?▼

Yes, PR diff analysis reviews changed lines to verify the preservation of security controls, applying framework-specific checks for React, Express, Django, Flask, Spring, Rails, and Go to identify vulnerabilities before merge.

How does a structured OWASP code review identify injection and authentication vulnerabilities?▼

A structured OWASP code review systematically scans by vulnerability class, prioritizing injection, authentication and session management, authorization, cryptography, data exposure, misconfiguration, and deserialization to identify security flaws.

What is the best way to produce formal security findings with file and line citations?▼

Produce formal security findings by citing the exact file and line, showing the vulnerable snippet, explaining the attack scenario, and proposing fixes with evidence aligned to OWASP Code Review Guide and Cheat Sheets.

Does this security review workflow support framework-specific checks for Django and Spring?▼

Yes, the security review workflow applies framework-specific checks tailored to detected frameworks including Django, Spring, React, Express, Flask, Rails, and Go to verify appropriate security controls.

How do I establish the correct scope and trust boundary for a secure code review?▼

Establish the correct scope for a secure code review by defining the language and framework, identifying the trust boundary across server, client, library, or CLI, and assessing data sensitivity and exposure.

Related Skills

Explore More Software Engineering Skills→
smarmen86smarmen86

review

Analyze git diffs against base branches for SQL vulnerabilities and code defects.

Community
Advanced
packetalienpacketalien

security-audit

Identify and remediate security vulnerabilities in game codebases.

Community
Advanced
PriyanshKuniyalPriyanshKuniyal

sast-configuration

Configures and manages SAST tools for automated vulnerability detection in CI/CD pipelines.

Community
Advanced
thisisqubikathisisqubika

security-review

Analyze code repositories for vulnerabilities using SAST and AI triage.

Official
Advanced