security-review

Automate security review of code changes with OWASP Top 10 checks and verdicts.

1|Updated Mar 15, 2026

Search Tags:#security #owasp #review #secrets-detection #dependency-scan #auth-audit #pipeline-gate

Ready to run

npx skills add https://github.com/paulingham/.claude --skill security-review-paulingham

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/paulingham/.claude/tree/main/skills/security-review
Command: npx skills add https://github.com/paulingham/.claude --skill security-review-paulingham

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill automates the security review phase by spawning a read-only security-engineer agent to audit changes for OWASP Top 10 vulnerabilities, secrets detection, and authentication/authorization checks, guarding the code against security regressions.

Core Features & Use Cases

Spawns a security-engineer agent to perform OWASP Top 10 audits, dependency scanning, and secrets detection.
Evaluates findings against a Severity scale (CRITICAL, HIGH, MEDIUM, LOW) and issues a verdict (APPROVE or CHANGES_REQUESTED) that gates Final Gate.
Works in parallel with other reviews and re-invokes when changes are needed, ensuring end-to-end security scrutiny.

Quick Start

Invoke security review on the current branch to surface OWASP, dependency, and secrets findings.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate security reviews for OWASP Top 10 vulnerabilities in my pipeline?▼

Automate security reviews by spawning a read-only security-engineer agent that audits code changes for OWASP Top 10 vulnerabilities, credential exposures, and misconfigurations. This process runs after the Build phase and produces a verdict that gates the Final Gate.

What is a security review pipeline gate and how does it work?▼

A security review pipeline gate blocks code merges by issuing a verdict based on severity findings. The agent issues APPROVE if no CRITICAL, HIGH, or MEDIUM findings exist, otherwise it returns CHANGES_REQUESTED to block progression.

How do I run secrets detection and dependency scanning in tandem with code reviews?▼

Run secrets detection and dependency scanning in tandem by applying the security review phase after the Build phase. The security-engineer agent evaluates findings in parallel with other reviews and re-invokes when changes are needed.

Does the security review agent support authentication and authorization audits?▼

Yes, the security review agent supports authentication and authorization audits. It performs these checks alongside OWASP Top 10 audits, dependency scanning, and secrets detection to guard against security regressions.

What severity levels trigger a CHANGES_REQUESTED verdict during a security audit?▼

Any CRITICAL, HIGH, or MEDIUM severity findings trigger a CHANGES_REQUESTED verdict. The security audit only issues an APPROVE verdict when no findings at these severity levels are detected.