security-reviewer

To run a security audit, invoke the skill on your project directory to scan source code for vulnerabilities like SQL injection and XSS. It analyzes your codebase and produces actionable reports with severity ratings and remediation guidance.

Yes, you can review cloud and container configurations for security misconfigurations. The skill analyzes your infrastructure security settings and provides hardening guidance to correct any identified deployment weaknesses.

SAST, or Static Application Security Testing, detects vulnerabilities by analyzing source code without executing it. The skill invokes SAST scans to identify insecure patterns, providing a baseline audit for common code-level security flaws.

Yes, this skill provides penetration testing support by offering guidance and tools for simulating attacks. It helps uncover infrastructure weaknesses through active testing, complementing static code review and SAST scans.

The best way to integrate DevSecOps practices is to perform a comprehensive security audit before deployment. The skill reviews new features, runs SAST scans, and checks configurations to ensure your codebase is secure for release.

To get remediation guidance after a code review, review the generated actionable reports. The skill automatically assigns severity ratings to identified vulnerabilities and provides specific steps to fix the security flaws.