security-review

Name: security-review
Availability: InStock
Author: Qubika

Analyze code repositories for vulnerabilities using SAST and AI triage.

Updated Jun 19, 2026

Search Tags:#security analysis #SAST #vulnerability scanning #repository security #LLM triage

Ready to run

npx skills add https://github.com/thisisqubika/ai-mast-challenge-promptazo --skill security-review-thisisqubika

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/thisisqubika/ai-mast-challenge-promptazo/tree/main/.claude/skills/security-review
Command: npx skills add https://github.com/thisisqubika/ai-mast-challenge-promptazo --skill security-review-thisisqubika

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires bandit, pip-audit, semgrep, gosec, govulncheck, cargo-audit, npm audit, bundle-audit, osv-scanner, trivy, checkov, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the security analysis and triage of code repositories, saving you time and ensuring a comprehensive security review.

Core Features & Use Cases

Hybrid SAST + LLM Analysis: Combines static code analysis with AI-driven triage.
Structured Reporting: Generates SARIF, JSON, and human-readable reports.
Integration with CI/CD: Triggered by pull requests or manual execution.
Use Case: Use this Skill in a CI/CD pipeline to automatically scan code repositories for vulnerabilities and generate detailed reports, or manually trigger a scan on specific repositories.

Quick Start

Run the security-review skill on the current repository with security-review.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate vulnerability scanning and triage for code repositories?▼

Automate repository vulnerability scanning by combining static application security testing with AI-driven triage. This hybrid approach detects vulnerabilities, classifies findings, and outputs structured SARIF, JSON, and human-readable reports.

Can I trigger repository security analysis from a CI/CD pipeline?▼

Yes, repository security analysis can be triggered by pull requests in a CI/CD pipeline or executed manually. It applies static application security testing and AI-driven triage to detect vulnerabilities and generate detailed structured reports.

What's the best way to run SAST across multiple programming languages?▼

Run SAST across multiple languages by utilizing integrated scanning tools like bandit, semgrep, gosec, cargo-audit, and npm audit. These dependencies perform static application security testing to detect vulnerabilities across diverse code repositories.

Does AI-driven triage work with static application security testing tools?▼

AI-driven triage works with static application security testing by combining SAST results with LLM analysis. This hybrid mechanism classifies detected vulnerabilities and generates structured SARIF, JSON, and human-readable reports for code repositories.

How do I generate SARIF reports from repository security scans?▼

Generate SARIF reports by executing the security analysis on your code repositories, which combines static application security testing and AI-driven triage. The scan automatically produces structured outputs in SARIF, JSON, and human-readable formats.