skills.rest
kollaborai
kollaboraiCOMMUNITY
Explore all skills by this author →
GitHub

security-review

Identify security vulnerabilities in Python codebases without modifying source files.

1|Updated May 5, 2026
Search Tags:#static analysis#OWASP#security review#code audit#vulnerability scanning#security reporting#python security
One-click install
npx skills add https://github.com/kollaborai/kollab --skill security-review-kollaborai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/kollaborai/kollab/tree/main/bundles/skills/security-review
Command: npx skills add https://github.com/kollaborai/kollab --skill security-review-kollaborai

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Manual security reviews are time-consuming, inconsistent, and often miss critical vulnerabilities like injection flaws, hardcoded secrets, and insecure authentication, leaving applications exposed to preventable attacks.

Core Features & Use Cases

This Skill provides a structured, 18-phase security review workflow fully aligned with OWASP guidelines, covering attack surface mapping, injection vulnerability detection, authentication and authorization checks, cryptography analysis, dependency scanning, and structured vulnerability reporting. It integrates with industry-standard tools like Bandit, Semgrep, pip-audit, and Trivy to automate static analysis and dependency checks, and generates detailed, actionable reports with severity classifications, CWE/OWASP mappings, and step-by-step remediation guidance. A typical use case is a development team running this Skill on a new Python web service before production deployment to catch SQL injection, hardcoded API keys, and insecure session management flaws early in the development cycle.

Quick Start

Use the security-review skill to conduct a full security audit of the current project's Python codebase and generate a prioritized vulnerability report.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run an OWASP-aligned security review on a Python codebase?▼

An OWASP-aligned security review applies a structured 18-phase workflow to check Python code for injection vulnerabilities, insecure authentication, and hardcoded secrets without modifying source files.

What is static analysis for Python web applications and how does it detect vulnerabilities?▼

Static analysis for Python web applications scans source code without execution, using Bandit and Semgrep to identify injection flaws, hardcoded secrets, and map findings to CWE classifications.

Can I perform a dependency vulnerability scan for Python without changing my source files?▼

Yes, you can perform a dependency vulnerability scan without changing source files by integrating pip-audit and Trivy to evaluate external libraries and flag known vulnerabilities.

Does this vulnerability scanning approach work for CLI tools and backend services?▼

Vulnerability scanning works for CLI tools and backend services by applying static analysis and authentication checks across the Python codebase to identify attack surface vulnerabilities.

What's the best way to generate structured security reports with severity classifications for Python code?▼

The best way to generate structured security reports with severity classifications is to run an automated code audit that maps vulnerabilities to CWE and OWASP guidelines with step-by-step remediation guidance.

Related Skills

Explore More Software Engineering Skills→
MatrixFounderMatrixFounder
4

skill-reverse-engineering

Scan directory structures and synthesize file summaries to regenerate architecture documentation.

Community
Intermediate
GaryOcean428GaryOcean428

security-audit

Detect secrets, insecure dependencies, and vulnerable patterns in codebases.

Community
Advanced
n-marusovn-marusov

aif-ci

Generate CI/CD pipeline configurations for GitHub Actions or GitLab CI.

Community
Advanced
jassicsjassics
6

mobile-pentest

Automate MASTG-based mobile penetration tests on Android and iOS apps.

Community
Advanced