security-review-v4

What problem does it solve?

This skill performs an OWASP Top 10 security review for pull requests, incorporating infrastructure context to minimize false positives. It posts findings as PR review comments or approves.

Core Features & Use Cases

• Framework-aware analysis with attack vector requirements to align findings with project context.
• Infrastructure-aware checks that trigger when infrastructure files are present (e.g., Bicep, Dockerfile, GitHub Actions workflows).
• Loading security baselines from standards and architecture to guide triage and suppression.
• Actionable findings include attack vectors, confidence levels, and remediation steps, posted as PR comments or approval decisions.
• Use Case: For PRs introducing authentication changes, infrastructure changes, or data flows, automatically surface critical risks and suggested mitigations.

Quick Start

Provide the PR number to start the security review flow.