security-review

Detect OWASP Top 10 vulnerabilities in code changes with static analysis.

2|Updated Mar 21, 2026
One-click install
npx skills add https://github.com/Throokie/claude-code-skills --skill security-review-throokie
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/Throokie/claude-code-skills/tree/main/skills/security-review
Command: npx skills add https://github.com/Throokie/claude-code-skills --skill security-review-throokie

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

AI-assisted security auditing for code changes to identify OWASP Top 10 vulnerabilities, authentication weaknesses, and data exposure risks, reducing security debt and speeding up secure delivery.

Core Features & Use Cases

  • OWASP Coverage: Detects common injection flaws (SQL, command), broken authentication, sensitive data exposure, and misconfigurations across languages.
  • Code Review Helper: Integrates with PR workflows to surface security findings and suggested remediations.
  • Usage Scenarios: Use during pull requests to scan diffs, or in CI pipelines for pre-merge checks.

Quick Start

Audit latest code changes to surface critical vulnerabilities and remediation guidance in one pass.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect OWASP vulnerabilities in code changes?

To detect OWASP vulnerabilities in code changes, you can apply static analysis patterns and grep-like searches to scan diffs for injection flaws, broken authentication, and sensitive data exposure across multi-language repositories.

Can I scan for sensitive data exposure in a multi-language repository?

Yes, you can scan for sensitive data exposure in a multi-language repository by applying configurable security rules and pattern matching to identify risks and surface remediation guidance directly in your code review.

How do I automate security reviews in CI workflows for pull requests?

You can automate security reviews in CI workflows by scanning pull request diffs to surface critical vulnerabilities, detecting misconfigurations and authentication weaknesses before merging, and receiving suggested remediations.

What is the best way to check for SQL injection and broken authentication in code diffs?

The best way to check for SQL injection and broken authentication in code diffs is applying OWASP Top 10 checks using static analysis patterns to identify common security flaws and provide actionable remediation guidance.

Does static analysis pattern matching work for detecting secret exposure in CI pipelines?

Yes, static analysis pattern matching works for detecting secret exposure in CI pipelines by applying configurable rules to scan code changes, identifying sensitive data exposure and misconfigurations during pre-merge checks.