security-review

Audit codebases for security risks with zero-trust dependency and configuration analysis.

Updated Aug 23, 2026

Search Tags:#security #audit #supply-chain #dependency-analysis #secret-scanning #code-forensics #malware-detection

Ready to run

npx skills add https://github.com/thanhtunguet/agent-skills --skill security-review-thanhtunguet

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/thanhtunguet/agent-skills/tree/main/security-review
Command: npx skills add https://github.com/thanhtunguet/agent-skills --skill security-review-thanhtunguet

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps teams perform thorough zero-trust security audits of codebases, reducing risk of hidden malware, insecure dependencies, and misconfigurations.

Core Features & Use Cases

Exhaustive dependency forensics across package manifests and lockfiles, with evidence-based flags for risky transitive dependencies.
Malicious code detection and secrets scanning across repository contents, CI/CD configurations, and container definitions.
CI/CD and supply-chain security assessment, including build scripts, Dockerfiles, and deployment manifests.

Quick Start

Run a comprehensive security audit of your repository to identify vulnerabilities, misconfigurations, and potential data leaks.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform a zero-trust security audit on my codebase to find hidden malware?▼

Perform a zero-trust security audit by analyzing repository contents, CI/CD configurations, and container definitions to detect malicious code. The audit exhaustively checks dependencies and code paths to provide evidence-based findings with precise file paths and remediation steps.

How does dependency analysis identify risky transitive dependencies in lockfiles?▼

Dependency analysis identifies risky transitive dependencies by performing exhaustive forensics across package manifests and lockfiles. It flags supply-chain violations with evidence-based findings, helping mitigate hidden security risks introduced by nested packages.

Can I scan CI/CD build scripts and Dockerfiles for insecure configurations and secrets?▼

Yes, you can scan CI/CD build scripts, Dockerfiles, and deployment manifests for insecure configurations and secrets. The assessment covers supply-chain security across these container definitions to prevent potential data leaks and misconfigurations.

What is the best way to scan repository contents for leaked secrets and malicious code?▼

The best way to scan for leaked secrets and malicious code is through a comprehensive repository audit. This process analyzes code paths and configurations to identify potential data leaks, providing actionable remediation steps for any vulnerabilities found.

Does the security audit provide specific file paths and lines for flagged vulnerabilities?▼

Yes, the security audit provides evidence-based findings with precise file paths and line ranges for flagged vulnerabilities. This ensures you receive actionable remediation steps directly tied to the exact locations of security risks in your codebase.