security-review

Automating STRIDE threat modeling for pull request security reviews is done by scanning PR diffs for spoofing, tampering, and elevation-of-privilege risks. The skill analyzes commits, validates findings for exploitability, and outputs standardized JSON files for patch generation.

You can scan a full code repository for vulnerabilities without a pre-existing threat model by running a full audit. The skill automatically generates a missing threat model, scans across multiple languages, and validates discovered exploitability risks for downstream patching.

STRIDE-based code review validates if a vulnerability is actually exploitable by analyzing commits and PR diffs, then applying threat modeling categories like information disclosure and DoS. It confirms exploitability and outputs validated findings in structured JSON formats.

The best way to integrate security findings into automated patch generation workflows is by exporting standardized JSON files. The skill outputs security-findings.json and validated-findings.json, which are designed for direct consumption by the security-patch-generation skill and CI workflows.

The security review skill supports scanning commits across different programming languages for vulnerabilities. It applies STRIDE-based threat modeling to code changes, validating findings for exploitability before delivering structured outputs for patch generation.