security-review

Audit a codebase for vulnerabilities and generate a scored markdown report.

7|4|Updated Mar 2, 2026

Search Tags:#security #vulnerability #codebase #audit #analysis #report

Ready to run

npx skills add https://github.com/nklisch/skills --skill security-review-nklisch

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/nklisch/skills/tree/main/plugins/workflow/skills/security-review
Command: npx skills add https://github.com/nklisch/skills --skill security-review-nklisch

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It provides an end‑to‑end, interactive security audit of any codebase, identifying vulnerabilities across multiple domains and delivering a clear, prioritized report.

Core Features & Use Cases

Stack discovery: Detect languages, frameworks, infrastructure, and attack surface before auditing.
Domain selection: Choose relevant security domains (auth, injection, secrets, dependencies, API, infra, crypto, error handling) or audit all.
Parallel sub‑audits: Run independent agents per domain, research best practices, and assess code against detailed checklists.
Scoring & reporting: Produce a graded markdown report with severity‑classified findings and remediation directions.
Scope flexibility: Audit the whole repository or a specific folder path.

Quick Start

Run the security-review skill on the repository root to generate a comprehensive security report.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I conduct a comprehensive security audit of my codebase?▼

A security audit detects vulnerabilities across authentication, injection, secrets, dependencies, API, infrastructure, cryptography, and error handling, producing a graded markdown report with severity classifications and actionable remediation guidance.

Can I audit a specific directory instead of the entire repository?▼

Yes, you can audit a specific folder path. The tool supports scope flexibility, allowing you to target either the entire repository or a specified directory for vulnerability analysis and reporting.

What security domains are covered during a codebase vulnerability analysis?▼

The vulnerability analysis covers authentication, injection, secrets, dependencies, API, infrastructure, cryptography, and error handling. You can audit all domains or select specific relevant ones during domain selection.

How does the security audit report prioritize remediation efforts?▼

The security audit report prioritizes remediation by providing a graded score and severity-classified findings. This scored markdown format helps you address the most critical vulnerabilities first.

Does the security audit detect frameworks and infrastructure before scanning?▼

Yes, the security audit performs stack discovery to detect languages, frameworks, infrastructure, and the attack surface before running independent parallel sub-audits against detailed security checklists.