skills.rest
leighmcculloch
leighmccullochCOMMUNITY
Explore all skills by this author →
Website𝕏@___leigh___GitHub

security-review

Trace data flows from untrusted inputs to dangerous operations and report vulnerabilities with PoCs.

1|Updated Jan 24, 2021
Search Tags:#vulnerability#audit#proof-of-concept#code-review#hardening#security-review
One-click install
npx skills add https://github.com/leighmcculloch/dotfiles --skill security-review-leighmcculloch
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/leighmcculloch/dotfiles/tree/main/files/claude/skills/security-review
Command: npx skills add https://github.com/leighmcculloch/dotfiles --skill security-review-leighmcculloch

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps teams identify real security vulnerabilities in codebases by focusing on actual exploitable paths and evidence-based findings, reducing noise from theoretical issues.

Core Features & Use Cases

  • Evidence-based vulnerability detection: Traces data flows from untrusted input to dangerous operations to validate findings.
  • PoC-driven reporting: Requires proof-of-concept demonstrations for each confirmed vulnerability.
  • Hardening guidance: Provides actionable security hardening recommendations separate from confirmed flaws for defense-in-depth.

Quick Start

Provide a security-focused code review for the specified codebase, identify real vulnerabilities with PoCs, and generate a structured Security Review report.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I identify real, exploitable security vulnerabilities in my codebase?▼

To identify real security vulnerabilities effectively, trace data flows from untrusted inputs to dangerous operations. This approach validates findings with evidence and proof-of-concept demonstrations, reducing noise from theoretical issues.

What is the best way to perform a security code review that provides proof of exploitability?▼

The best way to perform a security code review is by requiring proof-of-concept demonstrations for each confirmed vulnerability. This validates exploitability by tracing untrusted data flows to dangerous operations.

Can I audit libraries and configurations across different programming languages for security flaws?▼

Yes, you can audit libraries and configurations across languages for security flaws. The review applies broadly to codebases, tracing data flows from untrusted inputs to dangerous operations to find real vulnerabilities.

How do I generate actionable hardening recommendations for my codebase?▼

To generate actionable hardening recommendations, separate confirmed flaws from defense-in-depth guidance. This provides clear hardening recommendations alongside a final Security Review document.

Why does my automated security audit report theoretical issues instead of real vulnerabilities?▼

Automated security audits often report theoretical issues because they lack data flow tracing from untrusted inputs to dangerous operations. Evidence-based vulnerability detection requires verifying exploitability with proof-of-concept demonstrations.

Related Skills

Explore More Software Engineering Skills→
grigbgrigb
4

codebase-investigator

Trace execution flows and detect unhandled errors in codebases.

Community
Advanced
micaelmaltamicaelmalta
1

security-reviewer

Identify and remediate security vulnerabilities across code, configuration, and architecture.

Community
Advanced
balic-AI-ML-R-D-Resourcesbalic-AI-ML-R-D-Resources

security-entry-point-analyzer

Map and analyze application entry points to assess security risk.

Official
Intermediate
langbyyilangbyyi
96

cors-cross-origin-misconfiguration

Identify exploitable CORS misconfigurations enabling cross-origin theft of authenticated user data.

Community
Intermediate