skills.rest
vh2224
vh2224COMMUNITY
Explore all skills by this author →
GitHub

security-review

Trace code paths with STRIDE and OWASP to identify prioritized security findings.

1|Updated Jul 13, 2026
Search Tags:#owasp#threat modeling#security review#stride#vulnerability audit#exploit paths
One-click install
npx skills add https://github.com/vh2224/forge-executor --skill security-review-vh2224
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/vh2224/forge-executor/tree/main/src/resources/skills/security-review
Command: npx skills add https://github.com/vh2224/forge-executor --skill security-review-vh2224

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you perform a threat-model-driven security review of code changes, features, or subsystems so you can catch real vulnerabilities before they ship. It focuses on actual attack paths, not generic checklists, and produces actionable findings with severity and remediation.

Core Features & Use Cases

  • Attack Surface Mapping: Identifies untrusted entry points such as HTTP routes, CLI inputs, webhooks, environment variables, and file reads.
  • STRIDE and OWASP Analysis: Evaluates spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege, and common web risks like injection, XSS, SSRF, CSRF, and path traversal.
  • Filing-Ready Reporting: Produces prioritized findings with code locations, exploit scenarios, severity, reachability, and remediation guidance.
  • Use Case: Review an authentication change, a new webhook handler, or a database-access path before release and surface the highest-risk issues first.

Quick Start

Ask for a security review of the specific change, subsystem, or commit you want audited, and include any concern you already have about authentication, input handling, data access, or external interfaces.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a STRIDE threat model analysis on code changes before release?▼

To perform a STRIDE threat model analysis on code changes, trace untrusted entry points through code-level paths, evaluating spoofing, tampering, and elevation of privilege risks to produce prioritized, filing-ready security findings.

What is the best way to audit code for OWASP vulnerabilities like injection and SSRF?▼

The best way to audit code for OWASP vulnerabilities like injection and SSRF is mapping attack surfaces such as HTTP routes and webhooks, then applying threat-model-driven analysis to identify real exploit paths and information disclosure risks.

How do I trace exploit paths in authentication and data access subsystems?▼

Tracing exploit paths in authentication and data access subsystems requires evaluating untrusted entry points and applying STRIDE analysis to map reachability, severity, and remediation guidance for detected vulnerabilities.

Can I review external interfaces and webhook handlers for path traversal and XSS risks?▼

Yes, you can review external interfaces and webhook handlers for path traversal and XSS risks by identifying untrusted inputs and applying threat-model-driven analysis to surface actionable findings with exploitability and impact ratings.

Does this security review approach work for auditing environment variables and CLI inputs?▼

Yes, this security review approach works for auditing environment variables and CLI inputs by mapping them as attack surface entry points and evaluating them for tampering, denial of service, and information disclosure vulnerabilities.

What limitations exist when using automated threat modeling for suspected vulnerabilities?▼

Automated threat modeling for suspected vulnerabilities requires specifying the exact subsystem or commit for auditing and works best when you provide context on concerns like authentication or data access to trace accurate code-level exploit paths.

Related Skills

Explore More Software Engineering Skills→
dakshrawat298-gifdakshrawat298-gif

security-entry-point-analyzer

Map application entry points and input pathways to model the attack surface.

Community
Advanced
zapabobzapabob
2

sec-audit

Scan dependencies and custom code for security vulnerabilities.

Community
Advanced
reomgitreomgit

cso

Audit code, infrastructure, and dependencies for OWASP Top 10 and STRIDE threats.

Community
Advanced
djankiesdjankies

reviewing-security

Detect security vulnerabilities in JavaScript/TypeScript codebases with Semgrep and pattern checks.

Community
Advanced