skills.rest
pextacy
pextacyCOMMUNITY
Explore all skills by this author →
GitHub

security-review

Scan codebases for OWASP Top 10 risks and report prioritized fixes.

Updated Apr 3, 2026
Search Tags:#security#codebase#owasp#dependencies#audit#review#vulnerabilities
One-click install
npx skills add https://github.com/pextacy/stellar --skill security-review-pextacy
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/pextacy/stellar/tree/main/skills/security-review
Command: npx skills add https://github.com/pextacy/stellar --skill security-review-pextacy

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill enables teams to systematically identify and mitigate security risks in codebases by conducting thorough security audits aligned with OWASP Top 10, secrets detection, input validation checks, authentication/authorization assessment, and dependency security reviews.

Core Features & Use Cases

  • OWASP Top 10 coverage: scans and reports on common vulnerabilities including authentication, authorization, and configuration issues.
  • Secrets and sensitive data discovery: detects hardcoded keys, tokens, and credentials in the codebase.
  • Input validation and data sanitization review: evaluates user input handling to prevent injections and unsafe patterns.
  • Dependency security analysis: flags vulnerable or outdated dependencies and suggests remediations.
  • Use Case: before deploying a new API, run security review to produce a prioritized remediation plan with file-level findings.

Quick Start

Run a security review on the current codebase to generate a comprehensive report.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run an OWASP Top 10 security audit on my codebase?▼

To run an OWASP Top 10 security audit, this tool scans your codebase to identify and report security weaknesses, focusing on authentication flaws, authorization issues, and configuration risks. It generates a structured report with file paths and severity levels.

What is the best way to detect hardcoded secrets and credentials in source code?▼

Detecting hardcoded secrets involves scanning the codebase for exposed sensitive data like API keys and tokens. This tool performs secrets detection to find these vulnerabilities and provides remediation steps to secure the exposed credentials.

How do I check for vulnerable dependencies and get CVE references?▼

Checking for vulnerable dependencies involves analyzing your project libraries against known security flaws. This tool flags vulnerable or outdated dependencies, produces a structured report with specific CVE references, and suggests prioritized fixes.

Can I review input validation and data sanitization gaps for specific modules?▼

Yes, you can review input validation gaps for specific modules. The tool evaluates user input handling to prevent injections and unsafe patterns, allowing you to scope the security review to the entire codebase or targeted modules.

Does this security review generate a prioritized remediation plan with file-level findings?▼

Yes, the security review generates a prioritized remediation plan. It outputs structured reports detailing file paths, severity levels, and specific remediation steps to help teams systematically mitigate identified codebase vulnerabilities.

Related Skills

Explore More Software Engineering Skills→
phrazzldphrazzld
13

security-scan

Analyze whole-codebase data flows for OWASP Top 10 vulnerabilities.

Community
Advanced
LerianStudioLerianStudio
205

ops-security-audit

Automate infrastructure security audits with phased scanning and compliance mapping.

Official
Advanced
martinholovskymartinholovsky
45

CI/CD Pipeline Security Expert

Automate CI/CD pipeline security hardening with GitHub Actions.

Community
Advanced
kivo360kivo360
1

moai-domain-security

Mitigate security vulnerabilities in CI/CD pipelines using OWASP Top 10 and SAST/DAST workflows.

Community
Advanced