skills.rest
gao-hongnan
gao-hongnanCOMMUNITY
Explore all skills by this author →
Website𝕏@gaohongnanGitHub

security-review

Analyze source code changes for security vulnerabilities using taint analysis and OWASP standards.

3|Updated May 12, 2026
Search Tags:#code review#security#vulnerability#owasp#audit#taint analysis
One-click install
npx skills add https://github.com/gao-hongnan/omniagents --skill security-review-gao-hongnan
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/gao-hongnan/omniagents/tree/main/plugins/reviewer/skills/security-review
Command: npx skills add https://github.com/gao-hongnan/omniagents --skill security-review-gao-hongnan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill addresses the critical need for systematic security vulnerability detection during code reviews, helping developers identify and mitigate risks like injection, authentication gaps, and data exposure before they reach production.

Core Features & Use Cases

  • Taint Tracing: Automatically traces data flow from untrusted sources to dangerous sinks to identify injection vulnerabilities.
  • Security Hunts: Provides structured protocols for auditing secret spills, cryptographic misuse, and dependency risks.
  • Use Case: When submitting a pull request that introduces a new API endpoint, use this Skill to ensure that all user-provided inputs are properly sanitized and that ownership checks are correctly implemented to prevent IDOR vulnerabilities.

Quick Start

Use the security-review skill to perform a comprehensive vulnerability audit on the current code changes.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I identify security vulnerabilities in source code changes?▼

Security vulnerability detection targets OWASP Top 10 and CWE Top 25 standards to systematically identify risks like SQL injection, cross-site scripting, and sensitive data exposure during code reviews.

How does taint analysis work for finding SQL injection and XSS vulnerabilities?▼

Taint analysis works by automatically tracing data flow from untrusted sources to dangerous sinks, pinpointing injection vulnerabilities like SQL injection and cross-site scripting in the codebase.

How do I audit code for sensitive data exposure and secret spills?▼

Audit code for sensitive data exposure and secret spills by applying structured security hunting protocols that validate ownership checks and detect cryptographic misuse within API endpoints.

Can I use this to prevent IDOR vulnerabilities when adding new API endpoints?▼

You can prevent IDOR vulnerabilities when adding new API endpoints by using security auditing to ensure all user-provided inputs are properly sanitized and ownership checks are correctly implemented.

Does this security audit validate against OWASP Top 10 and CWE Top 25 standards?▼

Yes, this security audit validates code changes against OWASP Top 10 and CWE Top 25 standards to ensure robust defense-in-depth implementation and mitigate common attack vectors.

Related Skills

Explore More Software Engineering Skills→
manuelbrandner85manuelbrandner85

graph-evolution

Compare Trailmark code graphs across snapshots to detect security-relevant structural changes.

Community
Advanced
outfitter-devoutfitter-dev
28

security-engineering

Audit codebases for security vulnerabilities and misconfigurations using OWASP and CWE mappings.

Official
Advanced
VoDaiLoczVoDaiLocz
24

lint-and-validate

Automate linting and static analysis of code in CI pipelines.

Community
Intermediate
DevHive1DevHive1
18

security_scan

Orchestrate dependency, static analysis, and privacy dataflow scanners into prioritized reports.

Community
Advanced