security-review

Identify and remediate security weaknesses in codebases with OWASP Top 10 checks.

3|Updated Apr 7, 2026
One-click install
npx skills add https://github.com/Tienching/oh-my-codebuddy --skill security-review-tienching
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/Tienching/oh-my-codebuddy/tree/main/.codex/skills/security-review
Command: npx skills add https://github.com/Tienching/oh-my-codebuddy --skill security-review-tienching

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security auditing and risk assessment for codebases by performing structured security reviews to identify vulnerabilities, misconfigurations, and insecure patterns.

Core Features & Use Cases

  • OWASP Top 10 scan (A01-A10), secrets detection, input validation review, authentication/authorization assessment, and dependency vulnerability scanning.
  • Detailed security review reports with severity-ranked findings, concrete file/line references, CVE references, and actionable remediation guidance.
  • Use Case: Run a security review after introducing new dependencies or changes to authentication logic to prevent production risks.

Quick Start

Initiate a full security assessment on your codebase to generate a remediation plan.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a security review on my codebase before production deployment?

A security review audits your codebase to identify and remediate vulnerabilities. It performs OWASP Top 10 checks, secrets detection, and dependency scanning to deliver a severity-ranked report with actionable remediation guidance.

What does an OWASP Top 10 code audit cover?

An OWASP Top 10 code audit covers security weaknesses like broken authentication, injection flaws, and insecure patterns. It assesses input validation, authorization logic, and dependency vulnerabilities to ensure comprehensive security posture.

Can I use this to scan for hardcoded secrets and dependency vulnerabilities?

Yes, you can scan for hardcoded secrets and dependency vulnerabilities. The security review detects sensitive information exposure and maps dependency flaws to specific CVE references within the generated report.

When should I run a codebase security audit?

Run a codebase security audit after adding new dependencies or changing authentication logic, and before production deployments. This timing ensures that newly introduced insecure patterns are caught and remediated prior to release.

What is the best way to assess input validation and authentication logic?

The best way to assess input validation and authentication logic is through a structured security review. It identifies insecure patterns, evaluates authorization controls, and provides concrete file and line references for targeted remediation.

Does the security review provide specific remediation steps for found vulnerabilities?

Yes, the security review provides specific remediation steps. It delivers a detailed report with severity rankings, concrete file and line references, and actionable guidance to fix identified weaknesses and misconfigurations.