skills.rest
thistleknot
thistleknotCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-review

Scan codebases for threats, secrets, and dependency CVEs.

Updated Apr 20, 2026
Search Tags:#threat modeling#STRIDE#security review#secret scanning#OWASP LLM#data-flow tracing#CVE audit
One-click install
npx skills add https://github.com/thistleknot/skills --skill security-review-thistleknot
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/thistleknot/skills/tree/main/security-review
Command: npx skills add https://github.com/thistleknot/skills --skill security-review-thistleknot

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security review reduces the risk of shipping vulnerable code by systematically identifying threats, insecure data flows, leaked secrets, and vulnerable dependencies before release.

Core Features & Use Cases

  • STRIDE-A threat modeling: Enumerate threats across trust boundaries, assess severity, and map mitigations including an Agent Misuse (LLM) extension.
  • OWASP Top 10 for LLM applications: Check high-impact LLM failure modes such as prompt injection, insecure output handling, excessive agency, and sensitive disclosure.
  • Data-flow tracing to sinks: Trace sources (e.g., request fields, uploads, LLM output) to dangerous sinks (e.g., SQL/shell/HTML/template rendering, eval/exec) and verify sanitization/parameterization.
  • Secret and credential detection: Scan diffs and full codebases for likely secrets, stop deployment on confirmed matches, and recommend rotation plus history rewrite.
  • CVE dependency audit: Run language-specific tooling to triage and gate releases based on CVE severity.

Quick Start

Run the security-review workflow on the codebase or PR diff before any production deployment, especially when untrusted input, auth changes, sensitive data, or new agent tools are involved.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a STRIDE threat model on codebases with untrusted input?▼

STRIDE threat modeling systematically enumerates threats across trust boundaries and assesses severity. It maps mitigations using an Agent Misuse (LLM) extension to catch security risks before deployment.

What is the best way to trace data-flow from source to dangerous sinks like SQL or shell?▼

Data-flow tracing tracks sources like request fields or uploads to dangerous sinks such as SQL, shell, or eval. It verifies proper sanitization and parameterization to prevent injection vulnerabilities.

Can I use this security review to gate deployments based on CVE dependency severity?▼

CVE dependency audits run language-specific tooling to triage vulnerabilities. You can gate releases based on CVE severity to ensure vulnerable dependencies are blocked before production deployment.

How does OWASP LLM vulnerability checking handle prompt injection and excessive agency?▼

OWASP LLM checks assess high-impact failure modes including prompt injection, insecure output handling, and excessive agency. It verifies mitigations for all blocking issues before deployment gating.

When do I need to run a full-codebase security review vs an incremental PR check?▼

Run full-codebase reviews before major production deployments involving untrusted input or auth changes. Use PR-gated incremental checks for routine diffs to trace data flows and catch new vulnerabilities.

Related Skills

Explore More Legal & Compliance Skills→
Andreicr1Andreicr1

security-reviewer

Trace untrusted input in web service code diffs to identify exploitable vulnerabilities.

Community
Intermediate
0xHoneyJar0xHoneyJar

audit-env

Scan environment files, client code, and git history for secret leakage.

Official
Advanced
sjinkssjinks

security-review-owasp-vulnerable-dependency-management

Assess vulnerable dependency management workflows and remediation controls.

Community
Advanced
jlawsjlaws
2

cmd-security-audit

Run STRIDE threat modeling and SAST vulnerability scans on codebases.

Community
Advanced