security-review

Trace data flow to identify exploitable security vulnerabilities in source code.

5|Updated Jan 20, 2026
One-click install
npx skills add https://github.com/mohamedgshoaib/reway --skill security-review-mohamedgshoaib
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/mohamedgshoaib/reway/tree/main/.agents/skills/security-review
Command: npx skills add https://github.com/mohamedgshoaib/reway --skill security-review-mohamedgshoaib

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill addresses the challenge of identifying exploitable security vulnerabilities in codebases by providing a structured, context-aware audit process that filters out theoretical noise and focuses on high-confidence, attacker-controlled patterns.

Core Features & Use Cases

  • Context-Aware Auditing: Automatically loads relevant security references (e.g., injection, XSS, auth) based on the code type being reviewed.
  • Confidence-Based Reporting: Distinguishes between high-confidence exploitable patterns and theoretical issues, ensuring actionable results.
  • Use Case: Use this during a pull request review to identify potential SQL injection or hardcoded secrets in a new API endpoint, ensuring only verified vulnerabilities are flagged for remediation.

Quick Start

Use the security-review skill to audit the provided file for potential authentication and authorization vulnerabilities.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I identify exploitable security vulnerabilities in source code?

Security auditing for injection flaws works by tracing data flow from attacker-controlled inputs to verify high-confidence risks. This context-aware process filters theoretical noise by analyzing framework-specific protections and server-side configurations.

Can I use automated code review to detect SQL injection and hardcoded secrets?

Automated code review detects SQL injection and hardcoded secrets by tracing attacker-controlled inputs to verify exploitable patterns. It applies context-aware analysis to distinguish high-confidence vulnerabilities from theoretical issues.

Does this security audit work across various programming languages and infrastructure configurations?

Security auditing applies across various programming languages and infrastructure configurations. It systematically analyzes framework-specific protections and server-side configurations to verify vulnerabilities regardless of the underlying tech stack.

What is the best way to perform a high-confidence security audit during a pull request?

High-confidence security auditing during a pull request requires tracing data flow and verifying attacker-controlled inputs. This context-aware approach filters theoretical noise, ensuring only verified vulnerabilities are flagged for remediation.

How does confidence-based reporting filter out theoretical vulnerabilities in a security review?

Confidence-based reporting filters theoretical vulnerabilities by verifying attacker-controlled inputs and tracing data flow. It distinguishes between high-confidence exploitable patterns and theoretical issues to ensure only actionable results are reported.

When should I not use a systematic security audit for vulnerability assessment?

Avoid systematic security auditing if you only need a quick syntax check or lack access to server-side configurations. High-confidence vulnerability assessment requires analyzing framework-specific protections and tracing data flow, which needs full context.