skills.rest
LumaKernel
LumaKernelCOMMUNITY
Explore all skills by this author →
𝕏@lumc_GitHub

review-security

Reviews pull request diffs for high-urgency security vulnerabilities with cited evidence.

17|1|Updated Dec 29, 2019
Search Tags:#code review#pull request#vulnerability#github#security review#gh cli#threat analysis
One-click install
npx skills add https://github.com/LumaKernel/dotfiles --skill review-security-lumakernel
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: review-security
Source: https://github.com/LumaKernel/dotfiles/tree/main/common/claude/skills/review-security
Command: npx skills add https://github.com/LumaKernel/dotfiles --skill review-security-lumakernel

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Manually auditing pull requests for exploitable security flaws is time-consuming and easy to miss critical issues. This Skill automates security-focused PR reviews by analyzing diffs and posting evidence-backed comments on urgent threats. ## Core Features & Use Cases - Diff-Based Security Analysis: Uses gh pr diff to inspect pull request changes and identify realistically exploitable attack vectors in the logic. - Evidence-Grounded Comments: Every finding includes urgency, a fix proposal, quoted evidence, and links to official documentation or RFCs, with no speculation. - External Verification: Consults open-source references such as GitHub repositories when needed to confirm behavior. - Use Case: A reviewer opens a PR touching authentication logic. Invoke this Skill to scan the diff, flag a concrete attack path, and post an inline review comment with a specific remediation and source links. ## Quick Start Review the current pull request for high-urgency security issues and post evidence-backed comments on the diff.

Frequently Asked Questions about review-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security review on a GitHub pull request?▼

Invoke the review-security skill on the target PR. It fetches the diff with gh pr diff, analyzes the changed logic for exploitable attack vectors, and posts inline review comments with urgency ratings and fix proposals.

What kinds of vulnerabilities does a PR security review detect?▼

It prioritizes issues that are concretely realizable, meaning flaws in the changed logic where a specific attack method can be proposed. Speculative or theoretical concerns are excluded by design.

Does the security review cite sources for its findings?▼

Yes. Every comment must include quoted evidence and source links, with technical terms linked to official documentation or RFCs. Content based on guesswork is explicitly prohibited.

Can the review suggest fixes for the vulnerabilities it finds?▼

Yes, but only when there is one obvious remediation approach. Otherwise it neutrally enumerates options. Threat-related suggestions always include a concrete method to implement the fix.

What are the limitations of automated PR security review?▼

It focuses only on high-urgency findings within the PR diff, so lower-severity issues and vulnerabilities in unchanged code may be missed. It complements, rather than replaces, broader audits and penetration testing.

Related Skills

Explore More Software Engineering Skills→
abhiroopbabhiroopb

gh-pr-read

Read and summarize GitHub pull requests using the gh CLI tool.

Community
Intermediate
21StarkCom21StarkCom

stark-review

Reviews GitHub pull requests across triage-selected domains using a single configurable LLM agent.

Official
Advanced
SanketAdlakSanketAdlak

multi-reviewer-patterns

Coordinate parallel code reviews across quality dimensions with deduplication and consolidated reporting.

Community
Intermediate
IMIOIMIO
5

security-pentest

Scan SmartWeb staging repositories and HTTP endpoints for security vulnerabilities.

Official
Advanced