security-assessment

Perform static analysis of application codebases to identify security vulnerabilities and OWASP Top 10 gaps.

Updated Mar 30, 2026

Search Tags:#static analysis #code review #OWASP #vulnerability detection #security assessment

Ready to run

npx skills add https://github.com/EmeaAppGbb/spec2cloud-microhack-greenfield --skill security-assessment-emeaappgbb

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-assessment
Source: https://github.com/EmeaAppGbb/spec2cloud-microhack-greenfield/tree/main/.github/skills/security-assessment
Command: npx skills add https://github.com/EmeaAppGbb/spec2cloud-microhack-greenfield --skill security-assessment-emeaappgbb

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

The security-assessment skill solves the problem of identifying security vulnerabilities, insecure patterns, and compliance gaps in application codebases.

Core Features & Use Cases

Audit Codebase: Identifies security vulnerabilities, insecure patterns, and compliance gaps.
Adaptive Depth: Starts with dependency CVEs and obvious patterns, escalating to deep code analysis.
OWASP Top 10 Mapping: Maps findings to the relevant OWASP Top 10 category for clarity.
Severity Ratings: Provides severity ratings (critical, high, medium, low) for prioritization.
Remediation Guidance: Offers actionable remediation guidance and ADR triggers for major decisions.

Quick Start

Activate the security-assessment skill with the 'security' path.

Frequently Asked Questions about security-assessment

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform a static analysis to find security vulnerabilities in my codebase?▼

Static analysis for security vulnerabilities scans your codebase to identify insecure patterns and compliance gaps, mapping findings directly to OWASP Top 10 categories and providing actionable remediation guidance.

How does vulnerability detection map to the OWASP Top 10 during a security assessment?▼

Vulnerability detection maps findings to the relevant OWASP Top 10 category by analyzing insecure code patterns and dependency issues, categorizing each identified vulnerability for clearer prioritization and remediation.

What is the best way to prioritize code review findings for application security?▼

Prioritize code review findings for application security by leveraging severity ratings assigned during static analysis, which categorize vulnerabilities into critical, high, medium, and low severity levels.

Can I use static analysis to check dependencies for known CVEs and compliance gaps?▼

Yes, static analysis checks dependencies for known CVEs and compliance gaps by starting with obvious vulnerability patterns and escalating to deep code analysis to detect insecure patterns across technologies.

Does static analysis for application security require access to my source code?▼

Static analysis for application security requires direct access to your codebase and documentation to accurately identify vulnerabilities, insecure patterns, and compliance gaps across various technologies.

What remediation guidance does a security assessment provide for detected vulnerabilities?▼

A security assessment provides actionable remediation guidance for detected vulnerabilities, including severity ratings and architecture decision record triggers to facilitate major security decisions.