skills.rest
andresdiegolanda
andresdiegolandaCOMMUNITY
Explore all skills by this author →
GitHub

security-review

Identify security issues in code using threat-model-driven review.

10|1|Updated Mar 8, 2026
Search Tags:#security#vulnerability#threat-modeling#code-review#secure-development#risk-prioritization
One-click install
npx skills add https://github.com/andresdiegolanda/design-first-ai --skill security-review-andresdiegolanda
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/andresdiegolanda/design-first-ai/tree/main/context/skills/security-review
Command: npx skills add https://github.com/andresdiegolanda/design-first-ai --skill security-review-andresdiegolanda

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps teams perform a structured threat-model review of code during the pre-merge phase, turning design judgments into actionable, executable guidance that focuses security risks.

Core Features & Use Cases

  • Prioritized findings: critical (block merge), important (must address before merge), and advisories (track and evaluate).
  • Context-aware checks: requires entry point, caller trust level, and data sensitivity to tailor findings.
  • Deterministic reporting: outputs a formatted findings report that guides secure coding decisions.

Quick Start

Review the code under review for security issues using the security-review skill and classify findings by priority.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a threat-model-driven code review for HTTP endpoints?▼

Threat-model-driven code review analyzes HTTP endpoints by evaluating entry points, caller trust levels, and data sensitivity to identify security vulnerabilities and output prioritized findings.

What is threat modeling in secure development for pre-merge code reviews?▼

Threat modeling in secure development structures pre-merge code reviews by turning design judgments into actionable, prioritized guidance that focuses on critical security risks before merging.

Can I prioritize security vulnerabilities found in background jobs and external boundaries?▼

Security vulnerabilities found in background jobs and external boundaries are prioritized using a three-tier system: critical issues block merge, important issues require addressing before merge, and advisories are tracked.

What context is needed to identify security issues in code accurately?▼

Identifying security issues in code accurately requires explicit context including the entry point, caller trust level, and data sensitivity to ensure deterministic and tailored vulnerability findings.

Does this security review approach work for sensitive data integration points?▼

This security review approach works for sensitive data integration points by applying threat-model-driven checks across external boundaries to enforce risk prioritization and generate deterministic findings reports.

When should I not use a threat-model-driven approach for code review?▼

A threat-model-driven approach for code review should not be used when explicit context like entry points, caller trust, or data sensitivity is unavailable, as deterministic results require these inputs.

Related Skills

Explore More Software Engineering Skills→
dougdliudougdliu

security-threat-model

Identify components, data stores, and trust boundaries to generate a Markdown threat model.

Community
Advanced
tech-leads-clubtech-leads-club
5.0k

security-best-practices

Analyze Python, JavaScript/TypeScript, and Go codebases for security best practices.

Official
Advanced
devendrapratapsinghdevendrapratapsingh
1

app-security

Scan application code for vulnerabilities and hardcoded secrets.

Community
Advanced
YukiIto1999YukiIto1999

source-code-scanning

Scan source code with Semgrep, CodeQL, and Bandit to detect vulnerabilities and secrets.

Community
Advanced