skills.rest
paultyng
paultyngCOMMUNITY
Explore all skills by this author →
GitHub

review-security

Perform structured security reviews with STRIDE, OWASP Top 10, and static analysis.

9|Updated Mar 22, 2026
Search Tags:#owasp#threat-modeling#static-analysis#stride#security-review#code-audit#vulnerability-scanning
One-click install
npx skills add https://github.com/paultyng/skill-issue --skill review-security-paultyng
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: review-security
Source: https://github.com/paultyng/skill-issue/tree/main/skills/review-security
Command: npx skills add https://github.com/paultyng/skill-issue --skill review-security-paultyng

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Manual security reviews are often inconsistent, miss critical vulnerabilities, and fail to leverage standardized frameworks or automated scanning tools, leaving codebases exposed to preventable risks.

Core Features & Use Cases

  • STRIDE Threat Modeling: Systematically identify spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege risks across code and infrastructure.
  • OWASP Top 10 Analysis: Detect common application vulnerabilities including broken access control, injection flaws, cryptographic failures, and authentication weaknesses.
  • Automated Scanning Integration: Run gosec, govulncheck, and optional deep tools like CodeQL to catch low-hanging fruit and known dependency CVEs.
  • Consolidated Reporting: Deduplicate findings across frameworks, prioritize by severity, and provide code-level references with tracking status for existing known issues.
  • Use Case: Run a full security audit of a Go microservice PR before merge to catch auth bypasses, SQL injection risks, and vulnerable dependencies without manual framework lookup.

Quick Start

Use the review-security skill to perform a complete security audit of the current branch's changed Go files, including STRIDE threat modeling, OWASP analysis, and automated gosec scanning.

Frequently Asked Questions about review-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a structured security review for a Go codebase?▼

Perform a structured security review by applying STRIDE threat modeling, OWASP Top 10 analysis, and automated static analysis scanning to identify vulnerabilities and deduplicate findings. This approach catches risks like auth bypasses and injection flaws in Go microservices.

What is STRIDE threat modeling in code audits?▼

STRIDE threat modeling systematically identifies spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege risks across code and infrastructure during security audits. It provides a framework to ensure comprehensive coverage of common attack vectors.

Can I scope a security audit to just the changed files in a pull request?▼

Yes, you can scope security audits to PR diffs to identify vulnerabilities in changed Go files before merge. This targeted assessment still integrates OWASP analysis, STRIDE modeling, and automated gosec scanning for the modified code.

Does this security review approach integrate automated vulnerability scanning tools?▼

Yes, the security review integrates automated scanning tools including gosec, govulncheck, and optional deep analysis tools like CodeQL. These catch low-hanging fruit and known dependency CVEs alongside manual framework-aligned checks.

How do I consolidate and prioritize findings from multiple security analysis frameworks?▼

Consolidate findings by deduplicating vulnerabilities discovered across STRIDE, OWASP, and static analysis. Results are prioritized by severity and include code-level references with tracking status for existing known issues in a unified report.

What are the limitations of using OWASP Top 10 analysis for infrastructure as code?▼

OWASP Top 10 analysis targets application vulnerabilities like broken access control and cryptographic failures, while STRIDE modeling specifically addresses infrastructure risks. Combining both ensures comprehensive coverage for infrastructure as code and application codebases.

Related Skills

Explore More Software Engineering Skills→
utsavthakurutsavthakur

code-security-auditor

Audit codebases with static analysis and generate structured risk reports.

Community
Advanced
moongci38-ossmoongci38-oss

forge-check-security

Scan codebases for security vulnerabilities using a 15-phase model.

Community
Advanced
skkeoriwskkeoriw

requesting-code-review

Execute pre-commit code review with static analysis and automated tests.

Community
Advanced
TumeloRamaphosaTumeloRamaphosa

canary

Monitors live applications after deployment for console errors, performance regressions, and page failures.

Community
Intermediate