security-review

Identify security risks in branch changes and generate a markdown findings report.

Updated Mar 19, 2026

Search Tags:#vulnerability #risk-assessment #threat-modeling #security-audit #pull-request #security-review #code-diff

Ready to run

npx skills add https://github.com/japurcell/skills --skill security-review-japurcell

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/japurcell/skills/tree/main/skills/security-review
Command: npx skills add https://github.com/japurcell/skills --skill security-review-japurcell

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Complete a focused security review of the changes on the current branch, to identify vulnerabilities and risk vectors before merging.

Core Features & Use Cases

Scans pending diffs for common security issues across input validation, authentication/authorization, secrets management, crypto handling, data exposure, and code execution pathways.
Produces a structured markdown findings report with severities, rationale, and remediation suggestions suitable for developers and reviewers.
Useful for audits, pull requests, and pre-merge checks to quickly triage security risk on changes.

Quick Start

Review the pending branch changes and generate a structured security findings report.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I run a security review on a pull request diff?▼

To run a security review on a pull request, scan the pending branch changes to evaluate input validation, authentication, secrets management, and code execution risks, producing a structured markdown findings report with severities and remediation suggestions.

What is threat modeling for code changes and how does it work?▼

Threat modeling for code changes involves assessing the diff context to identify security risks and vulnerabilities before merging. It evaluates data exposure, crypto handling, and authorization pathways, returning a structured report with clear severity labels and rationale.

Can I use this security audit for my entire codebase?▼

This security audit is not designed for entire codebase analysis. It limits the assessment strictly to the diff context of the current branch, focusing vulnerability detection on pending code changes rather than pre-existing repository code.

What is the best way to identify security risks before merging a branch?▼

The best way to identify security risks before merging is to perform a focused security audit on the branch diff. This evaluates input validation and secrets management, generating a markdown document with concise rationale and concrete remediation recommendations.

Does the vulnerability findings report include remediation steps?▼

Yes, the vulnerability findings report includes concrete remediation recommendations. The structured markdown output provides clearly labeled severities, concise rationale for each identified risk, and actionable steps for developers and reviewers.