secure-code

Review source code for security vulnerabilities with CWE mappings and concrete fixes.

3|Updated May 28, 2026

Search Tags:#security #vulnerability #owasp #remediation #static-analysis #code-review #cwe

Ready to run

npx skills add https://github.com/mahg-es/araya --skill secure-code

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: secure-code
Source: https://github.com/mahg-es/araya/tree/main/skills/secure-code
Command: npx skills add https://github.com/mahg-es/araya --skill secure-code

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Review source code for security vulnerabilities following OWASP ASVS and CWE Top 25.

Core Features & Use Cases

Manual code review guidance: Provide expert findings with CWE mappings and recommended fixes.
Threat modeling support: Aligns with secure-by-design practices during code review.
Use Case: Before merging security-sensitive PRs, review authentication, input validation, and data access paths to surface vulnerabilities.

Quick Start

Run a security-focused code review on the provided source files to identify vulnerabilities and propose concrete fixes.

Frequently Asked Questions about secure-code

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I review source code for security vulnerabilities following OWASP ASVS?▼

Run a security-focused code review on your source files to identify vulnerabilities based on OWASP ASVS and CWE Top 25. This process surfaces actionable findings with CWE mappings, severity ratings, and concrete remediation guidance for authentication and data access code.

What is the best way to fix CWE Top 25 vulnerabilities before merging a pull request?▼

The best way to fix CWE Top 25 vulnerabilities is to review authentication, input validation, and data access paths before merging security-sensitive PRs. This surfaces vulnerabilities and provides expert findings with concrete fixes aligned with secure-by-design practices.

Can I get concrete remediation guidance for input validation flaws found during a code review?▼

Yes, you can receive concrete remediation guidance for input validation flaws. The review generates a structured report mapping each vulnerability to its CWE identifier, assigning a severity level, and proposing specific code fixes.

How does threat modeling support align with secure-by-design code review practices?▼

Threat modeling support aligns with secure-by-design practices by integrating expert vulnerability findings into the code review workflow. This ensures security flaws in sensitive areas like authentication and data access are identified and remediated before deployment.

Does this static analysis approach work for manual code review of authentication logic?▼

Yes, this approach works for manual code review of authentication logic by applying OWASP ASVS standards to your source files. It evaluates security-sensitive code paths to deliver actionable findings with CWE mappings and recommended fixes.

What is included in a structured security vulnerability report for source code?▼

A structured security vulnerability report includes actionable findings with CWE mappings, severity ratings, and concrete remediation guidance. It surfaces flaws detected in authentication, input handling, and data access code during the review process.