security-deep-review

Detect and mitigate security vulnerabilities in code reviews.

Updated Dec 23, 2025

Search Tags:#authentication #XSS #injection #static-analysis #code-review #security-review

Ready to run

npx skills add https://github.com/yaochangyu/ai-dev-toolkit --skill security-deep-review

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-deep-review
Source: https://github.com/yaochangyu/ai-dev-toolkit/tree/main/.github/skills/security-deep-review
Command: npx skills add https://github.com/yaochangyu/ai-dev-toolkit --skill security-deep-review

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps teams perform in-depth security reviews of source code to identify and remediate injection, authentication, authorization, and data handling weaknesses before they reach production.

Core Features & Use Cases

Deep review of code for injection, XSS, CSRF, and authentication vulnerabilities.
Use during PR reviews, refactors, or when implementing security-critical features to generate actionable remediation guidance.
Provide structured security remediation notes and best-practice recommendations for developers and security teams.

Quick Start

Run the security-deep-review on a target path, for example: @workspace 使用 security-deep-review 審查 src/

Frequently Asked Questions about security-deep-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform a security review to detect injection and XSS vulnerabilities in code?▼

To perform a security review for injection and XSS vulnerabilities, you need an in-depth code analysis process that applies rule-based pattern checks to identify weaknesses. It generates structured remediation suggestions to mitigate issues before production.

What is static analysis for code security and when should I use it?▼

Static analysis for code security is the process of reviewing source code to find authentication, authorization, and data handling weaknesses without executing it. You should use it during PR reviews, refactors, or when implementing security-critical features across languages.

Can I use this security review process across different languages and frameworks?▼

Yes, this security review process applies to code reviews across languages and frameworks. It targets security-critical features to detect and mitigate vulnerabilities by applying pattern checks and best-practice guidance regardless of the specific tech stack.

How do I get structured remediation suggestions for CSRF and authentication vulnerabilities?▼

To get structured remediation suggestions for CSRF and authentication vulnerabilities, run a deep code review on the target source path. The review identifies the specific weaknesses and provides actionable best-practice recommendations for developers to implement.

What is the best way to integrate code security checks into a PR review workflow?▼

The best way to integrate code security checks into a PR review workflow is to run an in-depth review on the target path before merging. This catches injection and data handling issues early and provides structured notes for developers to remediate.

Why does my code review fail to catch authentication and authorization weaknesses?▼

Your code review may fail to catch authentication and authorization weaknesses if it lacks in-depth static analysis and rule-based pattern checks. A thorough security review applies best-practice guidance to detect these specific data handling vulnerabilities.