skills.rest
andrew-t-james
andrew-t-jamesCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-review

Audit codebases for OWASP Top 10 vulnerabilities and hardcoded secrets.

Updated Jul 3, 2025
Search Tags:#security#owasp#dependencies#audit#secrets#code-review
One-click install
npx skills add https://github.com/andrew-t-james/dotfiles --skill security-review-andrew-t-james
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/andrew-t-james/dotfiles/tree/main/dot_codex/skills/security-review
Command: npx skills add https://github.com/andrew-t-james/dotfiles --skill security-review-andrew-t-james

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Conducts a comprehensive security review of codebases, identifying OWASP Top 10 vulnerabilities, hardcoded secrets, and insecure patterns to improve security posture.

Core Features & Use Cases

  • OWASP Top 10 scan
  • Secrets detection
  • Input validation review
  • Authentication/authorization assessment
  • Dependency vulnerability checks
  • Use Case: Pre-deployment security audit of web apps and APIs to surface critical issues and provide remediation guidance.

Quick Start

Run a full security review of your codebase focusing on OWASP Top 10, secrets, input validation, authentication, and dependencies.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run an automated security audit on my codebase?▼

A security audit scans your codebase to detect vulnerabilities like the OWASP Top 10, hardcoded secrets, and insecure patterns. It applies to code reviews, PR checks, and pre-deployment scans across web apps and APIs to surface critical issues.

What does OWASP Top 10 code review check for in web applications?▼

OWASP Top 10 code review checks web applications for critical security vulnerabilities. It assesses input validation, authentication, authorization, and insecure dependencies to provide remediation guidance before deployment.

Can I use this security scan for pre-deployment checks on APIs?▼

Yes, you can use this security scan for pre-deployment checks on APIs. It performs comprehensive vulnerability detection including secrets detection and dependency scanning specifically tailored for web apps and APIs.

What is the best way to detect hardcoded secrets in source code?▼

The best way to detect hardcoded secrets is through an automated codebase security review. This process identifies exposed credentials and insecure patterns while simultaneously checking for dependency vulnerabilities.

Does dependency vulnerability scanning include input validation assessment?▼

Yes, dependency vulnerability scanning is included alongside input validation assessment. A full security review evaluates both external library risks and internal code logic to ensure comprehensive protection against threats.

Related Skills

Explore More Software Engineering Skills→
JosiahSiegelJosiahSiegel
51

defender-for-devops

Integrate Microsoft Defender for DevOps into Azure Pipelines for automated security scanning.

Community
Advanced
grasberggrasberg
3

security-auditor

Audits code and infrastructure vulnerabilities and compliance gaps across deployments.

Community
Advanced
BagelHoleBagelHole
46

sast-scanning

Performs static security testing on source code using Semgrep, CodeQL, and SonarQube.

Community
Intermediate
Serg28Serg28

security-reviewer

Automate security audits with semgrep, trivy, gitleaks, and dependency scanners.

Community
Intermediate