security-review

Identify security risks in codebases during reviews.

2|1|Updated Dec 19, 2022

Search Tags:#authorization #threat-modeling #code-review #PII #secrets-management #security-review #dependency-risk

Ready to run

npx skills add https://github.com/nicholasgriffintn/machine-setup --skill security-review-nicholasgriffintn

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/nicholasgriffintn/machine-setup/tree/main/ai-tooling/skills/security-review
Command: npx skills add https://github.com/nicholasgriffintn/machine-setup --skill security-review-nicholasgriffintn

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security reviews identify vulnerabilities and risks in codebases, configurations, and workflows, guiding teams to strengthen authentication, authorization, secrets handling, and dependency management.

Core Features & Use Cases

Threat modeling and risk assessment for authN/authZ, secrets, public endpoints, and data handling.
Actionable remediation guidance and checklists that can be applied during code reviews or design discussions.
Dependency risk assessment and secure upgrade recommendations for project maintenance.

Quick Start

Run the Security Review Skill on your project to generate a structured risk assessment, remediation steps, and future hardening recommendations.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I identify security risks and vulnerabilities during a code review?▼

Security reviews identify vulnerabilities by analyzing codebases for authentication, authorization, secrets handling, public endpoints, and dependency risks, generating actionable remediation steps and checklists without altering code.

What is threat modeling for software projects and when do I need it?▼

Threat modeling assesses security risks in authN/authZ, secrets, and data handling. It is needed during code reviews or design discussions to generate structured risk assessments and future hardening recommendations.

Can I assess dependency risk and get secure upgrade recommendations for my project?▼

Yes, security reviews include dependency risk assessment to identify vulnerable packages and provide secure upgrade recommendations for ongoing project maintenance.

Does this security review process modify my codebase to fix issues?▼

No, the security review requires only read-only analysis of your codebase, configurations, and workflows. It outputs actionable remediation guidance and checklists but does not alter your code.

What's the best way to harden software and check for PII or secrets management issues?▼

Run a security review to evaluate secrets handling and PII exposure across your project. It produces structured risk assessments and remediation steps to strengthen your software's defenses.

Are there limitations to using automated security reviews for authorization and public endpoints?▼

The review is limited to read-only analysis and cannot fix issues directly. It focuses on identifying risks in authorization and public endpoints, outputting guidance for manual remediation.