security-review

Trace data flow to identify exploitable vulnerabilities in code.

Updated May 5, 2026

Search Tags:#code review #security #vulnerability #owasp #audit #injection

Ready to run

npx skills add https://github.com/iani-kuli/harness_bro --skill security-review-iani-kuli

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/iani-kuli/harness_bro/tree/main/.claude/skills/ported/security-review
Command: npx skills add https://github.com/iani-kuli/harness_bro --skill security-review-iani-kuli

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill addresses the challenge of performing thorough security code reviews by providing a structured, context-aware framework that filters out noise and focuses on high-confidence, exploitable vulnerabilities.

Core Features & Use Cases

Context-Aware Auditing: Automatically loads relevant security references (e.g., OWASP, SSRF, Injection) based on the code type being reviewed.
Confidence-Based Reporting: Enforces a strict reporting standard that requires tracing data flow to confirm exploitability, significantly reducing false positives.
Use Case: When reviewing a new API endpoint, use this Skill to trace user input from the request to the database, ensuring that parameters are properly sanitized and that the endpoint is protected against SQL injection and mass assignment.

Quick Start

Use the security-review skill to audit the current file for potential OWASP vulnerabilities and injection flaws.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform a security code review that reduces false positives?▼

Security code review reduces false positives by tracing data flow from attacker-controlled input to verify exploitability against framework-level mitigations. This confidence-based reporting enforces strict standards to confirm exploitable vulnerabilities like injection and XSS.

What is the best way to audit an API endpoint for OWASP vulnerabilities like injection?▼

Auditing an API endpoint for OWASP vulnerabilities involves tracing user input from the request to the database to ensure parameters are sanitized. This process confirms protection against SQL injection and mass assignment by checking framework-level mitigations.

How does context-aware auditing identify exploitable vulnerabilities in a codebase?▼

Context-aware auditing identifies exploitable vulnerabilities by automatically loading relevant security references like OWASP and SSRF based on the code type. It traces data flow to verify attacker-controlled input against framework mitigations for high-confidence reporting.

Can I use this approach to check for authentication bypass and XSS in my code?▼

Yes, you can check for authentication bypass and XSS by systematically reviewing code to trace data flow and verifying attacker-controlled input. This confirms exploitability against framework-level mitigations to satisfy high-confidence security reporting.

When do I need systematic security auditing for mass assignment and SSRF vulnerabilities?▼

You need systematic security auditing for mass assignment and SSRF when reviewing new endpoints to ensure user input is properly sanitized. Tracing data flow against framework mitigations confirms exploitability and adherence to OWASP best practices.

Why does tracing data flow matter for high-confidence security reporting?▼

Tracing data flow matters for high-confidence security reporting because it verifies attacker-controlled input against framework-level mitigations to confirm actual exploitability. This strict standard significantly reduces false positives in vulnerability detection.