security-review

Name: security-review
Availability: InStock
Author: Factory

Identify and validate security vulnerabilities in code changes using STRIDE threat modeling.

101|10|Updated Jan 12, 2026

Search Tags:#security #vulnerability #audit #threat-modeling #stride #code-review

Ready to run

npx skills add https://github.com/Factory-AI/factory-plugins --skill security-review-factory-ai

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/Factory-AI/factory-plugins/tree/main/plugins/security-engineer/skills/security-review
Command: npx skills add https://github.com/Factory-AI/factory-plugins --skill security-review-factory-ai

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security reviews of code changes are time-consuming and error-prone without a structured threat modeling approach.

Core Features & Use Cases

STRIDE-based vulnerability scanning during PR reviews, weekly scans, and full repository audits.
Validated findings with structured outputs for downstream patch generation.
Threat model generation and artifact generation (.factory/threat-model.md) to guide remediation.

Quick Start

Invoke the security-review skill on a PR or repository to generate a STRIDE threat model and a findings report.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate vulnerability scanning during PR reviews?▼

Automate vulnerability scanning during PR reviews by invoking this Skill to apply STRIDE threat modeling, validate findings, and generate structured patches for downstream remediation.

What is STRIDE threat modeling for code changes?▼

STRIDE threat modeling for code changes is a structured method to identify and validate security vulnerabilities by categorizing threats like spoofing, tampering, and information disclosure across repository audits.

Do I need a threat model file to run a security audit?▼

Yes, you need a threat model file at .factory/threat-model.md to guide the security audit, or you can have the Skill generate this artifact to proceed with structured remediation.

Can I run a full repository security audit without manual code review?▼

Yes, you can run a full repository security audit without manual code review by executing this Skill to generate a STRIDE threat model and output a validated findings report automatically.

What is the best way to generate patches for security vulnerabilities?▼

The best way to generate patches for security vulnerabilities is using a structured STRIDE analysis that produces validated findings, enabling downstream skills to apply targeted code remediation.

Does weekly vulnerability scanning require a threat model artifact?▼

Yes, weekly vulnerability scanning requires a threat model artifact at .factory/threat-model.md to structure the STRIDE analysis and validate security findings for ongoing code reviews.