skills.rest
AutomatedMarketer
AutomatedMarketerCOMMUNITY
Explore all skills by this author →
GitHub

security-reviewer

Scan application code, configuration, and dependencies for security vulnerabilities.

Updated Mar 17, 2026
Search Tags:#owasp#threat modeling#security review#secret detection#dependency audit#vulnerability scanning#semgrep
One-click install
npx skills add https://github.com/AutomatedMarketer/claude-skills --skill security-reviewer-automatedmarketer
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-reviewer
Source: https://github.com/AutomatedMarketer/claude-skills/tree/main/skills/security-reviewer
Command: npx skills add https://github.com/AutomatedMarketer/claude-skills --skill security-reviewer-automatedmarketer

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps teams detect, explain, and prioritize security weaknesses before they become production incidents. It combines automated scanning with manual review so vulnerabilities, exposed secrets, risky dependencies, and insecure configurations are caught early.

Core Features & Use Cases

  • Automated Security Scanning: Runs checks for secrets, static analysis findings, and dependency vulnerabilities across common development stacks.
  • Manual Security Review: Evaluates authentication, authorization, input handling, error handling, headers, and other high-risk code paths.
  • Threat and Compliance Analysis: Maps issues to OWASP Top 10, CWE Top 25, STRIDE, and SLSA so findings are actionable for engineering and audit workflows.
  • Use Case: A team preparing a release can use this Skill to perform a final security sweep, generate a vulnerability report, and receive prioritized remediation guidance.

Quick Start

Use this skill to review the repository for security issues, identify the most important risks, and give clear remediation steps in priority order.

Frequently Asked Questions about security-reviewer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security review on application code before a release?▼

A pre-release security review combines automated scanning using Semgrep, Gitleaks, npm audit, and pip-audit with manual validation against OWASP Top 10 and CWE Top 25 to identify and prioritize vulnerabilities.

What is threat modeling using STRIDE for application security?▼

STRIDE threat modeling categorizes security threats like spoofing and tampering during a security review, mapping identified risks to actionable remediation steps for engineering and compliance workflows.

Does this security review approach support mobile apps and APIs?▼

Yes, the security review covers web apps, mobile apps, APIs, and infrastructure, evaluating static analysis findings, secret detection, dependency audits, and security headers across these environments.

Can I use Semgrep and Gitleaks together for vulnerability scanning?▼

Yes, combining Semgrep for static analysis and Gitleaks for secret detection during a security review automatically identifies code vulnerabilities and exposed secrets before mapping them to compliance standards.

How do I detect exposed secrets and risky dependencies in my codebase?▼

Detecting exposed secrets and risky dependencies involves running Gitleaks for secrets alongside npm audit and pip-audit for vulnerabilities, followed by manual validation of high-risk code paths.

What is the best way to map code vulnerabilities to the OWASP Top 10?▼

Mapping vulnerabilities to OWASP Top 10 requires a combined security review running automated scans and manual validation, ensuring findings are actionable for both engineering remediation and audit workflows.

Related Skills

Explore More Software Engineering Skills→
brenordvbrenordv

security

Audit software systems for security vulnerabilities and regulatory compliance.

Community
Advanced
mzniumzniu
7

tech_evaluation

Assess technology readiness, scalability, security, and architectural risks in a structured report.

Community
Advanced
HelloEverybobyHelloEveryboby
17

SDLCOrchestrator

Automate SAST, DAST, and SCA security scans in CI/CD pipelines.

Community
Intermediate
kaustubhhiwarekaustubhhiware

security-reviewer

Audit code and cloud configurations for security vulnerabilities.

Community
Advanced