skills.rest
mark-torres10
mark-torres10COMMUNITY
Explore all skills by this author →
GitHub

review-security

Applies Semgrep code-security and OpenAI security-best-practices skills to review code for vulnerabilities.

3|Updated Feb 15, 2025
Search Tags:#code analysis#owasp#secure coding#security review#semgrep#vulnerability check
One-click install
npx skills add https://github.com/mark-torres10/ai_tools --skill review-security-mark-torres10
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: review-security
Source: https://github.com/mark-torres10/ai_tools/tree/main/skills/review-security
Command: npx skills add https://github.com/mark-torres10/ai_tools --skill review-security-mark-torres10

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security reviews often require combining multiple rule sets and best-practice guides, and it is easy to miss vulnerabilities when relying on a single source. This Skill orchestrates two established security skills so every review covers both automated Semgrep scanning and language-specific secure coding guidance. ## Core Features & Use Cases - Dual-Skill Orchestration: Loads and applies both the code-security (Semgrep) and security-best-practices (OpenAI) skills in a single workflow. - Combined Findings Report: Merges vulnerabilities, misconfigurations, and risky patterns from both skills into one deduplicated report with remediations and OWASP references. - Use Case: When implementing an authentication flow or handling user input, ask for a security review and receive Semgrep rule findings plus framework-specific hardening guidance with concrete file and line fixes. ## Quick Start Ask the agent to run a security review on the current code changes using both the Semgrep and security best practices skills.

Frequently Asked Questions about review-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security review on my code with Semgrep?▼

Ask the agent for a security review and it loads the code-security skill, which runs Semgrep rules and OWASP Top 10 checks against your code. Findings are combined with secure coding guidance into a single report with remediations.

What security skills does this review workflow require?▼

It requires two installed skills: code-security (Semgrep) for OWASP rules and pattern scanning, and security-best-practices (OpenAI) for language and framework-specific guidance. Both must be present in the global or project-level Cursor skills directory.

What happens if one of the required security skills is missing?▼

The skill states which one is missing and continues with the one that is available rather than failing silently. If both are missing, it skips the review entirely and tells you to install them.

When should I use a combined security review instead of a single scanner?▼

Use it when implementing authentication, handling user input, or touching sensitive data, where automated Semgrep rules alone miss framework-specific issues. Combining both skills catches pattern-based vulnerabilities and contextual secure coding mistakes.

What output does the security review produce?▼

It produces a merged report containing findings (vulnerabilities, misconfigurations, risky patterns), concrete remediations with file and line references where possible, and links to applicable OWASP documentation. Overlapping results from both skills are deduplicated.

Related Skills

Explore More Software Engineering Skills→
dbrijeshdbrijesh

security-review

Review web application code for common security vulnerabilities and best practices.

Community
Advanced
antstanleyantstanley

fix-finding

Implements and verifies minimal patches for validated security findings.

Community
Advanced
BryantChiBryantChi
9

Supply Chain Security

Implement dependency governance and integrate SCA scans into CI pipelines.

Community
Advanced
balic-AI-ML-R-D-Resourcesbalic-AI-ML-R-D-Resources

semgrep-rule-creator

Generate custom Semgrep YAML rules for security vulnerability detection.

Official
Advanced