code-review-security

Name: code-review-security
Availability: InStock
Author: OWASP

Map code review findings to OWASP Top 10 and ASVS.

141|14|Updated Mar 22, 2026

Search Tags:#security #vulnerabilities #static-analysis #code-review #pre-merge #owasp-top-10 #asvs

Ready to run

npx skills add https://github.com/OWASP/secure-agent-playbook --skill code-review-security-owasp

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: code-review-security
Source: https://github.com/OWASP/secure-agent-playbook/tree/main/skills/code-review-security
Command: npx skills add https://github.com/OWASP/secure-agent-playbook --skill code-review-security-owasp

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill streamlines and structures secure code reviews by mapping findings to OWASP Top 10 and ASVS, reducing human error and improving pre-merge security confidence.

Core Features & Use Cases

Systematic vulnerability coverage across injection, authentication, authorization, cryptography, data exposure, misconfiguration, and deserialization.
Alignment with OWASP Top 10 and ASVS for consistent remediation guidance.
Useful for reviewing pull requests, auditing files or modules, and enforcing security gates during CI/CD.

Quick Start

Run the secure code-review workflow against the target repository to generate actionable findings.

Frequently Asked Questions about code-review-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform a secure code review mapped to OWASP Top 10 and ASVS?▼

To perform a secure code review mapped to OWASP Top 10 and ASVS, systematically analyze pull requests or modules for vulnerabilities like injection, authentication, and cryptography flaws, generating structured findings with remediation guidance.

Can I use static analysis to enforce pre-merge security gates in CI/CD?▼

Yes, you can enforce pre-merge security gates in CI/CD by running systematic static analysis checks for misconfiguration, authorization, and data exposure across languages and frameworks before merging pull requests.

What is the best way to audit a module for injection and deserialization vulnerabilities?▼

The best way to audit a module for injection and deserialization vulnerabilities is to execute structured security checks aligned with ASVS, ensuring consistent coverage and actionable remediation output for identified risks.

Does this secure code review process support multiple programming languages and frameworks?▼

Yes, this secure code review process supports multiple programming languages and frameworks, systematically checking for authentication, authorization, cryptography, and data exposure vulnerabilities across diverse technology stacks.

How do I structure code review findings for consistent security remediation?▼

You structure code review findings for consistent security remediation by mapping detected vulnerabilities directly to OWASP Top 10 and ASVS categories, producing actionable and standardized output for developers.

Why map pre-merge vulnerability checks to OWASP Top 10 during pull request reviews?▼

Mapping pre-merge vulnerability checks to OWASP Top 10 during pull request reviews reduces human error and improves security confidence by ensuring systematic coverage of injection, misconfiguration, and cryptography issues.