security-review-v3

Automate OWASP Top 10 security analysis on pull requests.

3|Updated Feb 20, 2026
One-click install
npx skills add https://github.com/drdatarulz/TI-Engineering-Standards --skill security-review-v3
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: security-review-v3
Source: https://github.com/drdatarulz/TI-Engineering-Standards/tree/main/skills/archive/security-review-v3
Command: npx skills add https://github.com/drdatarulz/TI-Engineering-Standards --skill security-review-v3

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Automates an OWASP Top 10 security review for pull requests, reducing manual review time and standardizing findings with framework-aware analysis.

Core Features & Use Cases

  • Framework-aware analysis for PRs with attack-vector requirements to minimize false positives
  • Posts findings as PR review comments or approvals to streamline code reviews
  • Context-aware triage using PR metadata (branch, files changed, framework) to generate targeted recommendations

Quick Start

Provide the PR context and run the analysis to generate actionable OWASP findings for the PR.

Frequently Asked Questions about security-review-v3

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate OWASP Top 10 security reviews for pull requests?

Automate OWASP Top 10 security reviews for pull requests by loading PR context with branch and file metadata to generate framework-aware, attack-vector-backed findings. This standardizes analysis and reduces manual code review time by producing deterministic, reproducible triage results.

Can I run automated threat modeling directly on a PR code review?

Automated threat modeling and security analysis can run directly on PR code reviews by evaluating changed files and project-specific constraints. The process identifies actionable risks tied to specific attack vectors, minimizing false positives through framework-aware triage.

How does framework-aware security analysis work for PRs?

Framework-aware security analysis works for PRs by evaluating project-specific constraints and PR metadata like the target branch and changed files. This contextual loading tailors the OWASP findings to the specific frameworks used, ensuring deterministic and reproducible triage results.

Does automated OWASP PR review work across different frameworks?

Automated OWASP PR review works across different frameworks by applying project-specific constraints to the analysis. It generates framework-aware results that adapt to the target codebase, ensuring findings remain relevant and actionable regardless of the underlying technology stack.

What is the best way to standardize security findings across pull requests?

Standardize security findings across pull requests by automating a structured OWASP Top 10 analysis that outputs deterministic, attack-vector-backed recommendations. This approach provides reproducible triage metadata and posts consistent review comments to streamline code approvals.

How do I reduce false positives in automated PR security analysis?

Reduce false positives in automated PR security analysis by using framework-aware evaluation backed by specific attack vectors. By loading authenticated PR context and applying project-specific constraints, the review generates targeted, actionable findings instead of generic alerts.