security-review-gate

Identify security risks in application code and config with evidence-backed reports.

Updated Apr 26, 2026

Search Tags:#authorization #security #authentication #review #risk-assessment #code-review #abuse-prevention

Ready to run

npx skills add https://github.com/ringlochid/coding-skills --skill security-review-gate

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-review-gate
Source: https://github.com/ringlochid/coding-skills/tree/main/security-review-gate
Command: npx skills add https://github.com/ringlochid/coding-skills --skill security-review-gate

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill provides structured, evidence-based evaluation of security risks in application code and configuration, enabling teams to identify and communicate risk without performing unauthorized probing.

Core Features & Use Cases

Evidence-based risk mapping across auth, session management, access controls, secrets, API exposure, and dependency surfaces.
Safe, audit-ready reporting that clearly separates scope, confirmed findings, proofs, and gaps, with guidance on remediation.
Reproducible workflow for security reviews across apps, PRs, routes, and release configurations.

Quick Start

Review the target application surfaces for security risk, and return an evidence-backed report including scope, findings, proofs, gaps, and the smallest safe fix.

Frequently Asked Questions about security-review-gate

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform an evidence-based security review on a pull request?▼

An evidence-based security review maps auth, session, access control, validation, secrets, API exposure, and dependency surfaces in the pull request to identify risks. It produces a concise report containing confirmed findings, proofs checked, missing proof, and the smallest safe fix.

What is the best way to map authentication and access control risks in application code?▼

Mapping authentication and access control risks involves reviewing application code and config to trace authorization boundaries and session management. The process yields an audit-ready report that separates confirmed findings from gaps in proof, without exposing secret values.

Can I use this security review approach for release configurations and routes?▼

Yes, you can apply this security review to release configurations, routes, and application surfaces. It evaluates security risks across these scopes by gathering explicit abuse-control evidence for login endpoints and API exposure, returning a structured risk assessment.

Does this code review method require active probing or unauthorized testing of endpoints?▼

No, this code review method does not require unauthorized probing or active endpoint testing. It evaluates security risks by gathering evidence statically from the application code and configuration, enabling teams to identify and communicate risk safely.

How do I report security findings without exposing secret values in the code?▼

You report security findings by generating an audit-ready document that includes the scope reviewed, confirmed findings, proofs checked, missing proof, and the smallest safe fix. This structured report communicates risk clearly while ensuring secret values are never exposed.

What does an abuse-control evidence check for login endpoints involve?▼

An abuse-control evidence check for login endpoints involves tracing authentication and session management logic in the code to verify protections against unauthorized access. It produces explicit proof of existing controls or highlights missing proof in the security report.