skills.rest
thedutchvisiongroup
thedutchvisiongroupOFFICIAL
Explore all skills by this author →
WebsiteGitHub

security-review

Detects vulnerabilities via dataflow tracing across 11 classes without modifying code.

Updated Mar 28, 2026
Search Tags:#owasp#security review#code audit#sast#vulnerability detection#dependency audit#dataflow analysis
One-click install
npx skills add https://github.com/thedutchvisiongroup/agent-skills --skill security-review-thedutchvisiongroup
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/thedutchvisiongroup/agent-skills/tree/main/skills/security-review
Command: npx skills add https://github.com/thedutchvisiongroup/agent-skills --skill security-review-thedutchvisiongroup

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Security issues slip through code review because reviewers skim instead of systematically tracing untrusted data to dangerous operations. This Skill enforces a six-phase, advisory-only security review that detects vulnerabilities with evidence (file:line, dataflow trace, CWE/OWASP mapping) and never edits the code under review. ## Core Features & Use Cases - Systematic 11-Class Review: Works through injection, XSS, access control, authentication/sessions, cryptography, secrets, dependencies/supply-chain, configuration/IaC, API security/SSRF, logging/privacy, and LLM/GenAI risks, anchored to OWASP Top 10 2025, CWE Top 25 2025, ASVS 5.0, and the OWASP API and LLM Top 10. - Tooling Plus Manual Verification: Runs available SAST, secrets, and dependency scanners (never installing anything), plus bundled scripts for deterministic secrets scanning and dependency extraction for online advisory lookup. - Mandatory Online Research: Resolves doubt about unfamiliar APIs, version-specific behavior, and dependency CVE status through authoritative sources (OSV, NVD, GitHub Advisory) instead of guessing. - Use Case: Before merging a pull request touching authentication and payment flows, run this Skill to map the attack surface, trace user input to SQL queries and shell calls, check dependency versions against OSV advisories, and receive a severity-grouped findings report with a fix-before-merge verdict. ## Quick Start Ask the AI to perform a security review of the changed files in this pull request, focusing on the authentication and payment flows.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security review on a pull request before merging?▼

Define the review scope (changed files or full codebase), identify sensitive flows like auth or payments, then let the Skill map the attack surface, run available scanners, and trace untrusted input to dangerous sinks. It delivers a severity-grouped findings report with a merge verdict.

What vulnerability classes does a static security review cover?▼

This review covers 11 classes: injection, XSS, access control, authentication and sessions, cryptography, secrets, dependencies and supply chain, configuration and IaC, API security and SSRF, logging and privacy, and LLM/GenAI risks. Each maps to OWASP Top 10 2025 and CWE Top 25 2025 anchors.

Does the security review fix the vulnerabilities it finds?▼

No. The Skill is strictly advisory-only: it detects, reports, and recommends fix directions but never edits, patches, or hardens code. Fixing is treated as a separate task after the review report is delivered.

Can it check dependencies for known CVEs?▼

Yes. The bundled extract_dependencies.py script normalizes manifests and lockfiles (npm, PyPI, Go, Cargo, Maven, and more) into a package list, which is then checked against online advisory databases like OSV, NVD, and GitHub Advisory.

What are the limitations of a static security review?▼

It never executes attacks or probes running systems, so findings needing runtime evidence or deployment context go into an explicit 'Could NOT verify' section. Code quality review is also out of scope and handed off to a separate code-review skill.

Related Skills

Explore More Software Engineering Skills→
vtexvtex
39

payment-pci-security

Route tokenized card data through a Secure Proxy for PCI DSS compliance.

Official
Advanced
malhashemimalhashemi
20

ticket-review

Review ticket documents for gaps, inconsistencies, and severity-classified issues.

Community
Intermediate
Norfolk-GroupNorfolk-Group

ce-simplify-code

Simplifies recently changed code for clarity, reuse, and efficiency while preserving behavior.

Official
Advanced
simotasimota
68

Probe

Perform dynamic security testing with OWASP ZAP and Burp Suite.

Community
Advanced