skills.rest
leejaedus
leejaedusCOMMUNITY
Explore all skills by this author →
GitHub

security-review

Identify OWASP Top 10 vulnerabilities, secrets, and misconfigurations in codebases.

Updated Feb 15, 2026
Search Tags:#security#authentication#owasp#input-validation#code-review#secrets-detection#dependency-security
One-click install
npx skills add https://github.com/leejaedus/pepcode --skill security-review-leejaedus
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/leejaedus/pepcode/tree/main/skills/security-review
Command: npx skills add https://github.com/leejaedus/pepcode --skill security-review-leejaedus

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Secure codebases by identifying OWASP Top 10 vulnerabilities, hardcoded secrets, and misconfigurations to reduce risk and improve security posture.

Core Features & Use Cases

  • OWASP Top 10 Scan: Detects vulnerabilities spanning A01 to A10 categories in code and configurations.
  • Secrets Detection: Flags hardcoded API keys, credentials, tokens, and private keys.
  • Input Validation: Reviews data validation to prevent injection attacks and ensure safe boundaries.
  • Authentication/Authorization: Assesses password hashing, session management, and access controls.
  • Dependency Security: Evaluates dependencies for known vulnerabilities and outdated components.

Quick Start

Run a full security review on your current project to generate a security report.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan my codebase for OWASP Top 10 vulnerabilities?▼

Scanning for OWASP Top 10 vulnerabilities involves analyzing code and configurations to detect issues across categories A01 to A10. This skill reviews cloud-native repositories and web applications to identify security risks and generate a structured report.

What is the best way to detect hardcoded secrets and API keys in source code?▼

Detecting hardcoded secrets involves scanning repositories for exposed credentials, tokens, and private keys. This skill flags hardcoded API keys during development and code review to prevent secret exposure and improve security posture.

How do I check for vulnerable dependencies in my web application?▼

Checking for vulnerable dependencies involves evaluating project libraries for known security flaws and outdated components. This skill performs dependency vulnerability scans to catch risks during development and deployment.

Can I review input validation and authentication mechanisms in a cloud-native repository?▼

Reviewing input validation and authentication in a cloud-native repository is fully supported. This skill assesses data boundaries to prevent injection attacks and evaluates password hashing, session management, and access controls.

Does this security analysis work for libraries during deployment?▼

Security analysis works for libraries during development, review, and deployment. It catches input validation gaps, authentication weaknesses, and misconfigurations to reduce risk across the entire software lifecycle.

Why should I use an automated security checklist for code review?▼

Using an automated security checklist ensures consistent detection of OWASP Top 10 issues, secrets exposure, and dependency vulnerabilities. It structures the review process to catch misconfigurations that manual code reviews often miss.

Related Skills

Explore More Software Engineering Skills→
lancedblancedb
9

area-manifest-authoring

Create or refresh documentation audit manifests by analyzing watched repositories and validating via the prepare step.

Official
Advanced
rcrathrcrath
1

wayq-regress

Monitor GitHub issues for regressions and report findings in audio format.

Community
Intermediate
garethdainegarethdaine

code-quality

Run Laravel Pint, PHPStan, and PHPUnit code quality checks.

Community
Intermediate
harnessharness
80

configure-repo-scan

Insert code scanning steps into existing Harness pipeline YAML.

Official
Intermediate