skills.rest
ElbertePlinio
ElbertePlinioCOMMUNITY
Explore all skills by this author →
Website𝕏@ElbertePlinioGitHub

security-review

Scan code changes and repositories for security vulnerabilities using STRIDE threat modeling.

Updated Jul 13, 2026
Search Tags:#security#vulnerability#audit#stride#code-review#cve#exploitability
One-click install
npx skills add https://github.com/ElbertePlinio/dotfiles --skill security-review-elberteplinio
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/ElbertePlinio/dotfiles/tree/main/private_dot_factory/plugins/marketplaces/factory-plugins/plugins/security-engineer/skills/security-review
Command: npx skills add https://github.com/ElbertePlinio/dotfiles --skill security-review-elberteplinio

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Manually reviewing code for security vulnerabilities is time-consuming, inconsistent, and prone to missing critical flaws, especially when aligning with standardized threat modeling frameworks like STRIDE. This Skill automates the process to deliver consistent, thorough security assessments.

Core Features & Use Cases

  • STRIDE-Based Vulnerability Scanning: Identifies spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege flaws across code changes, full repositories, or pull requests.
  • Exploitability Validation: Filters out false positives, assesses reachability and impact, and generates proof-of-concept details for confirmed high and critical vulnerabilities.
  • Dependency CVE Checking: Scans project dependencies for known common vulnerabilities and exposures, classifies reachability, and includes findings in the final report.
  • Use Cases: Run pre-merge PR security reviews, schedule weekly scans of recent commits, or perform full repository security audits for compliance or risk assessment.

Quick Start

Use the security-review skill to scan the current pull request for security vulnerabilities and output a validated findings report with prioritized remediation steps.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a STRIDE threat model security audit on a full repository?▼

STRIDE threat modeling identifies spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege flaws in your code. It provides a structured framework to systematically evaluate security vulnerabilities across web, backend, and mobile applications.

Can I scan pull requests for security vulnerabilities before merging?▼

Yes, this Skill supports pre-merge pull request reviews by scanning code changes for security vulnerabilities. It validates findings for exploitability, filters false positives, and outputs structured security reports to ensure safe merges.

Does the security review check project dependencies for known CVEs?▼

Yes, the security review scans project dependencies for known CVEs. It classifies reachability, assesses impact, and includes confirmed vulnerabilities in the final structured security report alongside code-level findings.

How does exploitability validation filter false positives in code reviews?▼

Exploitability validation filters false positives by assessing reachability and impact. For confirmed high and critical vulnerabilities, it generates proof-of-concept details to ensure only actionable security findings are included in the report.

What types of applications are supported for automated vulnerability scanning?▼

Automated vulnerability scanning supports web, backend, and mobile applications. The Skill applies STRIDE threat modeling to detect security flaws across full repositories, recent commits, and pull requests for these platforms.

Related Skills

Explore More Software Engineering Skills→
ascerra-fullsend-rehearsalascerra-fullsend-rehearsal

code-review

Analyze code changes for correctness, security, intent, style, and documentation compliance.

Official
Advanced
Factory-AIFactory-AI
101

security-review

Identify and validate security vulnerabilities in code changes using STRIDE threat modeling.

Official
Advanced
maslennikov-igmaslennikov-ig
2

code-reviewer

Automate pull-request code review across six languages with structured reports.

Community
Advanced
DexploarerDexploarer
7

compliance-auditor

Automate regulatory compliance audits for SOC2, HIPAA, GDPR, and PCI-DSS.

Community
Intermediate