skills.rest
thejordanleopold
thejordanleopoldCOMMUNITY
Explore all skills by this author →
Website𝕏@jordansleopoldGitHub

security-review

Identify and catalog code security vulnerabilities through static analysis and pattern matching.

4|Updated Apr 9, 2026
Search Tags:#security#vulnerability#owasp#threat-modeling#static-analysis#codeql#semgrep
One-click install
npx skills add https://github.com/thejordanleopold/claude-code-skills-distilled --skill security-review-thejordanleopold
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/thejordanleopold/claude-code-skills-distilled/tree/main/security-review
Command: npx skills add https://github.com/thejordanleopold/claude-code-skills-distilled --skill security-review-thejordanleopold

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Auditing code for security vulnerabilities with a repeatable, evidence-driven approach that links findings to concrete exploit scenarios and actionable remediation guidance.

Core Features & Use Cases

  • Static analysis orchestration using Semgrep and CodeQL with OWASP Top 10 mapping.
  • Variant analysis workflow to identify related vulnerabilities across code paths.
  • Structured reports and risk scoring suitable for security reviews and remediation planning.

Quick Start

Run a security audit across your codebase to produce a findings report and remediation guidance.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit code for security vulnerabilities using static analysis?▼

You can audit code for security vulnerabilities by configuring Semgrep rules and CodeQL databases to run static analysis. The process maps findings to OWASP Top 10:2025 risks and outputs structured remediation guidance.

How does OWASP Top 10 threat modeling work with static analysis tools?▼

Threat modeling with static analysis works by applying Semgrep and CodeQL pattern matching to scan code paths. It catalogs vulnerabilities against OWASP Top 10:2025 checks to validate findings and link them to concrete exploit scenarios.

Can I use Semgrep and CodeQL together for code security reviews?▼

Yes, you can use Semgrep and CodeQL together for code security reviews. This Skill requires configuring Semgrep rules and CodeQL databases to run variant analysis across code paths, producing a unified findings report for remediation planning.

What's the best way to prioritize code security fixes from audit findings?▼

The best way to prioritize code security fixes is through structured risk scoring. This Skill evaluates static analysis findings from Semgrep and CodeQL, linking vulnerabilities to concrete exploit scenarios to generate actionable remediation guidance.

Do I need to configure Semgrep rules before running a security audit?▼

Yes, you need to configure Semgrep rules and CodeQL databases before running a security audit. A defined workflow is required to validate findings, map them to OWASP Top 10:2025 checks, and produce remediation guidance.

How do I identify related vulnerabilities across different code paths?▼

To identify related vulnerabilities across code paths, this Skill uses a variant analysis workflow. By applying Semgrep and CodeQL pattern matching, it traces related security risks across languages and frameworks to catalog exploit scenarios.

Related Skills

Explore More Software Engineering Skills→
elizaOSelizaOS
19.0k

static-analysis

Run CodeQL and Semgrep scans and parse SARIF results.

Official
Advanced
MetalLegBobMetalLegBob
11

differential-review

Analyze code changes for security risks using git history and test coverage.

Community
Advanced
bigeasyfreemanbigeasyfreeman
2

security-review

Automate STRIDE threat modeling and OWASP Top 10 scanning on code changes before merging.

Community
Advanced
mahamaneharouna9-cpumahamaneharouna9-cpu

mode-exploit

Develop Python exploits for buffer overflows and RCE vulnerabilities.

Community
Advanced