secure-code-review

Integrate static analysis tools and manual inspection to identify security vulnerabilities in code.

5.6k|899|Updated Nov 8, 2025

Search Tags:#code review #OWASP #security #vulnerability #secure coding #SAST

Ready to run

npx skills add https://github.com/Ed1s0nZ/CyberStrikeAI --skill secure-code-review-ed1s0nz

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: secure-code-review
Source: https://github.com/Ed1s0nZ/CyberStrikeAI/tree/main/skills/secure-code-review
Command: npx skills add https://github.com/Ed1s0nZ/CyberStrikeAI --skill secure-code-review-ed1s0nz

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the critical need to identify and mitigate security vulnerabilities within software code, ensuring the integrity and safety of applications.

Core Features & Use Cases

Static Analysis (SAST): Integrates with tools like SonarQube, Checkmarx, Fortify, and Semgrep to automatically scan code for known security flaws.
Manual Review Guidance: Provides checklists and identifies common dangerous code patterns (e.g., SQL injection, XSS, command injection) to aid human reviewers.
Vulnerability Pattern Recognition: Details specific code examples and their secure alternatives for common vulnerabilities.
Use Case: Before deploying a new feature, run this Skill to perform an automated static analysis and a guided manual review of the codebase to catch potential security risks early in the development lifecycle.

Quick Start

Initiate a secure code review for the current project using Semgrep with auto-detected rules.

Frequently Asked Questions about secure-code-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform a security code review to catch vulnerabilities before deployment?▼

A security code review integrates static analysis tools like Semgrep with manual inspection to identify input validation flaws and insecure cryptographic practices. This approach catches vulnerabilities early by combining automated scanning with guided human review checklists.

Does this secure code review approach support OWASP Top 10 vulnerabilities?▼

Yes, secure code review adheres to OWASP Top 10 secure coding best practices to identify vulnerabilities like SQL injection, XSS, and command injection. It provides specific dangerous code pattern examples alongside their secure alternatives for comprehensive protection.

Can I use SAST tools like SonarQube and Checkmarx for automated vulnerability scanning?▼

Yes, static analysis (SAST) integrates with tools like SonarQube, Checkmarx, Fortify, and Semgrep to automatically scan code for known security flaws. This automated scanning is combined with manual review guidance to catch potential security risks early.

What's the best way to identify authentication and authorization weaknesses in my codebase?▼

The best way to identify authentication and authorization weaknesses is performing a comprehensive security code review using both SAST tools and manual inspection. This dual methodology focuses on finding access control flaws alongside output encoding issues and other dangerous code patterns.

How do I run an automated static analysis scan using Semgrep for my current project?▼

To run an automated static analysis scan using Semgrep, initiate a secure code review for your current project with auto-detected rules. This automatically scans your codebase for known security flaws before you deploy new features.

What types of code patterns are flagged during a manual security review?▼

During a manual security review, common dangerous code patterns such as SQL injection, XSS, and command injection are flagged. The review provides checklists and specific code examples with secure alternatives to aid human reviewers in identifying these vulnerabilities.