What problem does it solve? Manual security code reviews often produce noisy, low-confidence findings or miss exploitable vulnerabilities entirely. This Skill performs systematic security reviews that report only high-confidence, exploitable issues after researching the full codebase context. ## Core Features & Use Cases - Confidence-Based Reporting: Classifies findings as HIGH, MEDIUM, or LOW confidence and reports only confirmed exploitable vulnerabilities, filtering out framework-mitigated false positives like auto-escaped template variables. - Comprehensive Coverage: Includes reference guides for injection, XSS, CSRF, SSRF, deserialization, cryptography, authentication, authorization, and business logic flaws, plus language guides for Python, JavaScript, Go, Rust, and Java, and infrastructure guides for Docker, Kubernetes, Terraform, and CI/CD. - Use Case: Before merging a pull request that adds a new API endpoint, ask for a security review to detect issues like SQL injection, missing authorization checks, or hardcoded secrets, with each finding including location, impact, evidence, and remediation steps. ## Quick Start Ask the AI to perform a security review of the current file or diff and report any high-confidence vulnerabilities with severity ratings.
