skills.rest
thisisqubika
thisisqubikaOFFICIAL
Explore all skills by this author →
WebsiteGitHub

security-review

Analyze code repositories for vulnerabilities using SAST and AI triage.

Updated Jun 19, 2026
Search Tags:#security analysis#SAST#vulnerability scanning#repository security#LLM triage
One-click install
npx skills add https://github.com/thisisqubika/ai-mast-challenge-promptazo --skill security-review-thisisqubika
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/thisisqubika/ai-mast-challenge-promptazo/tree/main/.claude/skills/security-review
Command: npx skills add https://github.com/thisisqubika/ai-mast-challenge-promptazo --skill security-review-thisisqubika

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires bandit, pip-audit, semgrep, gosec, govulncheck, cargo-audit, npm audit, bundle-audit, osv-scanner, trivy, checkov, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the security analysis and triage of code repositories, saving you time and ensuring a comprehensive security review.

Core Features & Use Cases

  • Hybrid SAST + LLM Analysis: Combines static code analysis with AI-driven triage.
  • Structured Reporting: Generates SARIF, JSON, and human-readable reports.
  • Integration with CI/CD: Triggered by pull requests or manual execution.
  • Use Case: Use this Skill in a CI/CD pipeline to automatically scan code repositories for vulnerabilities and generate detailed reports, or manually trigger a scan on specific repositories.

Quick Start

Run the security-review skill on the current repository with security-review.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate vulnerability scanning and triage for code repositories?▼

Automate repository vulnerability scanning by combining static application security testing with AI-driven triage. This hybrid approach detects vulnerabilities, classifies findings, and outputs structured SARIF, JSON, and human-readable reports.

Can I trigger repository security analysis from a CI/CD pipeline?▼

Yes, repository security analysis can be triggered by pull requests in a CI/CD pipeline or executed manually. It applies static application security testing and AI-driven triage to detect vulnerabilities and generate detailed structured reports.

What's the best way to run SAST across multiple programming languages?▼

Run SAST across multiple languages by utilizing integrated scanning tools like bandit, semgrep, gosec, cargo-audit, and npm audit. These dependencies perform static application security testing to detect vulnerabilities across diverse code repositories.

Does AI-driven triage work with static application security testing tools?▼

AI-driven triage works with static application security testing by combining SAST results with LLM analysis. This hybrid mechanism classifies detected vulnerabilities and generates structured SARIF, JSON, and human-readable reports for code repositories.

How do I generate SARIF reports from repository security scans?▼

Generate SARIF reports by executing the security analysis on your code repositories, which combines static application security testing and AI-driven triage. The scan automatically produces structured outputs in SARIF, JSON, and human-readable formats.

Related Skills

Explore More Software Engineering Skills→
florianbuetowflorianbuetow
12

pasta-vulns

Scan code and dependencies for vulnerabilities mapped to CWEs.

Community
Advanced
sbknanasbknana
10

sarif-parsing

Parse SARIF files to deduplicate findings and generate structured reports.

Community
Advanced
fgarofalo56fgarofalo56
6

security-scanner

Scan container images, dependencies, and infrastructure configurations for security vulnerabilities.

Community
Advanced
rhpdsrhpds

25-security-scanning-vulnerability-research

Analyze codebase vulnerabilities and create Jira security tickets.

Official
Advanced