security-review

Name: security-review
Availability: InStock
Author: andresdiegolanda

Identify security issues in code using threat-model-driven review.

10|1|Updated Mar 8, 2026

Search Tags:#security #vulnerability #threat-modeling #code-review #secure-development #risk-prioritization

Ready to run

npx skills add https://github.com/andresdiegolanda/design-first-ai --skill security-review-andresdiegolanda

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/andresdiegolanda/design-first-ai/tree/main/context/skills/security-review
Command: npx skills add https://github.com/andresdiegolanda/design-first-ai --skill security-review-andresdiegolanda

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps teams perform a structured threat-model review of code during the pre-merge phase, turning design judgments into actionable, executable guidance that focuses security risks.

Core Features & Use Cases

Prioritized findings: critical (block merge), important (must address before merge), and advisories (track and evaluate).
Context-aware checks: requires entry point, caller trust level, and data sensitivity to tailor findings.
Deterministic reporting: outputs a formatted findings report that guides secure coding decisions.

Quick Start

Review the code under review for security issues using the security-review skill and classify findings by priority.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform a threat-model-driven code review for HTTP endpoints?▼

Threat-model-driven code review analyzes HTTP endpoints by evaluating entry points, caller trust levels, and data sensitivity to identify security vulnerabilities and output prioritized findings.

What is threat modeling in secure development for pre-merge code reviews?▼

Threat modeling in secure development structures pre-merge code reviews by turning design judgments into actionable, prioritized guidance that focuses on critical security risks before merging.

Can I prioritize security vulnerabilities found in background jobs and external boundaries?▼

Security vulnerabilities found in background jobs and external boundaries are prioritized using a three-tier system: critical issues block merge, important issues require addressing before merge, and advisories are tracked.

What context is needed to identify security issues in code accurately?▼

Identifying security issues in code accurately requires explicit context including the entry point, caller trust level, and data sensitivity to ensure deterministic and tailored vulnerability findings.

Does this security review approach work for sensitive data integration points?▼

This security review approach works for sensitive data integration points by applying threat-model-driven checks across external boundaries to enforce risk prioritization and generate deterministic findings reports.

When should I not use a threat-model-driven approach for code review?▼

A threat-model-driven approach for code review should not be used when explicit context like entry points, caller trust, or data sensitivity is unavailable, as deterministic results require these inputs.