skills.rest
kmshihab7878
kmshihab7878COMMUNITY
Explore all skills by this author →
GitHub

security-review

Review application code, infrastructure, and containers for security vulnerabilities.

6|1|Updated Apr 7, 2026
Search Tags:#owasp#ci-cd#code-review#security-review#container-security#vulnerability-assessment#secrets-scanning
One-click install
npx skills add https://github.com/kmshihab7878/claude-code-setup --skill security-review-kmshihab7878
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/kmshihab7878/claude-code-setup/tree/main/skills/security-review
Command: npx skills add https://github.com/kmshihab7878/claude-code-setup --skill security-review-kmshihab7878

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Provides a consistent, checklist-driven approach to finding and fixing security weaknesses in source code, configuration, containers, and CI/CD pipelines so engineering teams can reduce vulnerabilities before deployment.

Core Features & Use Cases

  • OWASP Top 10 & injection prevention: concrete checks and fixes for SQL injection, XSS, SSRF, template injection, and command injection.
  • Secrets management and scanning: guidance and search patterns for detecting committed secrets, plus pre-commit and CI scanning recommendations.
  • Authentication, authorization & transport: recommendations for secure password hashing, MFA, session management, TLS enforcement, and header policies.
  • Container and supply-chain hardening: best practices for minimal images, non-root execution, image pinning, multi-stage builds, and CI hardening.
  • Use Case: Review a pull request or Dockerfile and produce line-level violations with severity and a minimal, actionable code fix.

Quick Start

Run /security-review <file> to scan the file for violations, severity ratings, and a concrete code-level fix.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find and fix vulnerabilities in a pull request or Dockerfile?▼

To find and fix vulnerabilities in a pull request or Dockerfile, run a security review to generate line-level findings with severity classifications and concrete code-level remediation suggestions.

How does an OWASP-guided code review check for injection risks and secrets?▼

An OWASP-guided code review checks for injection risks by scanning for SQL injection, XSS, and SSRF, while detecting committed secrets using search patterns and pre-commit scanning recommendations.

Can I use this security review skill to harden CI pipelines and container configurations?▼

Yes, you can use this security review skill to harden CI pipelines and container configurations by enforcing minimal images, non-root execution, image pinning, multi-stage builds, and CI hardening best practices.

What's the best way to review authentication, authorization, and transport security in my code?▼

The best way to review authentication, authorization, and transport security is applying a checklist-driven approach that validates secure password hashing, MFA, session management, TLS enforcement, and header policies.

Does a line-level security scan provide actionable code fixes for API endpoints?▼

Yes, a line-level security scan provides actionable code fixes for API endpoints by producing concrete remediation suggestions alongside severity ratings for detected input validation and authorization weaknesses.

Why do I need a checklist-driven security review for my source code and infrastructure?▼

You need a checklist-driven security review for source code and infrastructure to consistently identify and fix security weaknesses before deployment, reducing vulnerabilities across application code, CI/CD pipelines, and containers.

Related Skills

Explore More Software Engineering Skills→
EojEdredEojEdred

security-hardening

Scan code and configurations for security vulnerabilities and replay risks.

Community
Intermediate
arbazkhan971arbazkhan971
26

devsecops

Integrate security scanning into CI/CD pipelines with blocking gates.

Community
Advanced
spallempatispallempati

secure-coding-enforcement

Integrate SAST tools into CI/CD to block pull requests with high-severity findings.

Community
Advanced
martinholovskymartinholovsky
45

CI/CD Pipeline Security Expert

Automate CI/CD pipeline security hardening with GitHub Actions.

Community
Advanced