What problem does it solve? Manual security audits are slow and prone to false positives from naive pattern matching. This Skill performs systematic security code reviews that trace data flow across the codebase, distinguishing genuinely exploitable vulnerabilities from framework-mitigated or server-controlled patterns, so you only act on high-confidence findings. ## Core Features & Use Cases - Confidence-Based Reporting: Classifies findings as HIGH, MEDIUM, or LOW confidence and reports only confirmed exploitable issues with severity ratings (Critical, High, Medium, Low). - Broad Vulnerability Coverage: Detects injection, XSS, CSRF, SSRF, IDOR, insecure deserialization, weak cryptography, authentication flaws, mass assignment, and business logic errors. - Language and Infrastructure Guides: Loads specialized references for Python, JavaScript, Go, Rust, Java, plus Docker, Kubernetes, Terraform, CI/CD, and cloud configurations. - Use Case: Before merging a pull request that adds a new API endpoint, ask for a security review to verify authorization checks, input validation, and rate limiting, receiving a structured report with evidence and remediation steps. ## Quick Start Ask the AI to perform a security review of the changed files in your current branch and report only high-confidence vulnerabilities with severity and fixes.
