skills.rest
rob-broadley
rob-broadleyCOMMUNITY
Explore all skills by this author →
GitHub

security-review

Evaluates code diffs for exploitable vulnerabilities using OWASP Top 10 2021 criteria.

Updated May 10, 2026
Search Tags:#owasp#injection#security review#ssrf#security logging#secrets hygiene#auth patterns
One-click install
npx skills add https://github.com/rob-broadley/ai-airbase --skill security-review-rob-broadley
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/rob-broadley/ai-airbase/tree/main/cadre/skills/security-review
Command: npx skills add https://github.com/rob-broadley/ai-airbase --skill security-review-rob-broadley

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you perform security reviews that focus on exploitable risks rather than style preferences, reducing the chance that authentication, authorization, input-handling, and configuration issues ship to production.

Core Features & Use Cases

  • OWASP Top 10 (2021) code-level signals: Provides concrete detection cues for broken access control, cryptographic failures, injection, insecure design, misconfiguration, outdated components, authentication failures, integrity failures, logging gaps, and SSRF.
  • Secrets hygiene and scanning guidance: Emphasizes gitleaks for leaked credentials across git history and highlights how secrets can appear in logs and error messages.
  • Practical validation and error-handling checks: Covers input validation, error message hygiene, auth patterns, and severity-based triage (Critical/High/Medium/Low).
  • Use Case: Review a pull request that touches login, permission checks, webhook handling, or external URL fetching, then map findings to a severity model to guide whether to block the merge.

Quick Start

Run the security review reference workflow for your latest code changes and check every auth boundary, input sink, external call, and secret-handling path against the OWASP Top 10 (2021) signals.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review code changes for OWASP Top 10 vulnerabilities?▼

Security review of code changes involves evaluating diffs against OWASP Top 10 risk patterns, mapping findings to code-level signals across auth boundaries and input sinks, then triaging using a four-tier severity model.

What is the best way to check pull requests for SSRF and injection risks?▼

Checking pull requests for SSRF and injection risks involves analyzing server-side fetching and input handling paths for exploitable vulnerabilities, then categorizing findings by severity to guide merge decisions.

How do I scan git history for leaked secrets and credentials?▼

Scanning git history for leaked secrets and credentials uses gitleaks to detect exposed tokens, ensuring that sensitive data does not appear in logs or error messages before deployment.

How should I triage security findings in a code review?▼

Triage security findings by mapping detected vulnerabilities to a four-tier severity model—Critical, High, Medium, and Low—to prioritize exploitable risks over style preferences and guide merge blocking.

Can I use automated security review for webhook consumers and CLI commands?▼

Automated security review effectively evaluates sensitive entry points like webhook consumers, CLI commands, and HTTP handlers to identify exploitable authentication, authorization, and input handling issues.

Why focus on exploitable risks instead of style preferences during security reviews?▼

Focusing on exploitable risks instead of style preferences during security reviews reduces the chance that critical authentication, authorization, and configuration vulnerabilities actually ship to production.

Related Skills

Explore More Software Engineering Skills→
TimoFreibergTimoFreiberg
2

tour

Explain code changes across Git and JJ diffs and pull requests.

Community
Intermediate
Manvendra08Manvendra08
1

springboot-verification

Enforce build validation, static analysis, test coverage, CVE scanning, and diff review for Spring Boot services.

Community
Advanced
naporin0624naporin0624
3

secret-scanner

Detect secrets and credentials in git repositories using Gitleaks.

Community
Advanced
brenordvbrenordv

security

Audit software systems for security vulnerabilities and regulatory compliance.

Community
Advanced