skills.rest
jpoley
jpoleyCOMMUNITY
Explore all skills by this author →
Website𝕏@jbpoleyGitHub

security-reviewer

Analyze codebases for security vulnerabilities, threats, and compliance gaps.

50|9|Updated Oct 15, 2025
Search Tags:#OWASP#compliance#threat-modeling#code-review#security-review#audits#SLSA
One-click install
npx skills add https://github.com/jpoley/flowspec --skill security-reviewer-jpoley
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-reviewer
Source: https://github.com/jpoley/flowspec/tree/main/.claude/skills/security-reviewer
Command: npx skills add https://github.com/jpoley/flowspec --skill security-reviewer-jpoley

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps security teams and developers quickly identify vulnerabilities, threats, and compliance gaps in codebases, architectures, and processes.

Core Features & Use Cases

  • Vulnerability Review: Systematically assess code, dependencies, and configurations for common weaknesses.
  • Threat Modeling: Build STRIDE-based threat models and derive mitigations.
  • Compliance & Documentation: Map findings to frameworks (OWASP, CWE, PCI-DSS, ISO 27001) and generate audit-ready reports.
  • Use Case: When assessing a new feature, run a security analysis to produce a threat model, a remediation checklist, and suggested design changes.

Quick Start

Invoke the security-reviewer on a repository or code snippet to generate a security assessment, threat model, and remediation guidance.

Frequently Asked Questions about security-reviewer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I identify security vulnerabilities in my codebase?▼

Security vulnerability identification analyzes code, dependencies, and configurations against frameworks like OWASP Top 10 and CWE to surface weaknesses. This Skill systematically assesses your repository and outputs actionable findings with remediation guidance.

What is threat modeling and how does STRIDE help with security design?▼

STRIDE threat modeling structures security analysis around six threat categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. This Skill builds STRIDE-based threat models from your architecture and derives concrete mitigations.

How do I ensure my code meets compliance frameworks like PCI-DSS and ISO 27001?▼

Compliance mapping links code findings to regulated frameworks (PCI-DSS, ISO 27001, OWASP) and produces audit-ready reports. This Skill documents gaps and evidence, accelerating compliance assessment and remediation tracking.

Can I use this for security code reviews across different project types?▼

Yes. This Skill applies security review and threat modeling across projects, architectures, and dependencies, making it suitable for feature assessments, new integrations, and full codebase audits regardless of project structure.

What does SLSA compliance involve and how do I verify it?▼

SLSA (Supply chain Levels for Software Artifacts) defines supply chain security levels. This Skill assesses your build, dependency, and release processes against SLSA criteria and identifies compliance gaps with remediation steps.

How do I generate a security assessment and remediation checklist?▼

Invoke this Skill on your repository or code snippet to produce a structured security assessment, threat model, and prioritized remediation checklist with design change recommendations.

Related Skills

Explore More Software Engineering Skills→
Snowflake-LabsSnowflake-Labs
12

read-ors-configuration

A concise summary of your roleplay character: name,</name> personality, and/or behavior, formatted as a single string sentence. Typically不超过50字，此处省略

Official
Intermediate
AradotsoAradotso
11

sparkfinderoven-claude-security-compliance-suite

Scan code for OWASP issues, dependency CVEs, secrets, and IAM risks.

Official
Advanced
zzw4257zzw4257

OWASP Dependency-Check

Scan project dependencies for known vulnerabilities using OWASP Dependency-Check.

Community
Intermediate
ResgridResgrid
224

security-scan

Scan .NET applications for security weaknesses with severity-rated findings.

Official
Advanced