speckit-security-review-audit

Audit Spec-Kit projects for security domains and generate remediation tasks.

Updated Mar 16, 2026

Search Tags:#threat modeling #security review #devsecops #spec-kit #owasp top 10 #dependency risk

Ready to run

npx skills add https://github.com/B0yZ4kr14/OrthoPlus-Enterprise --skill speckit-security-review-audit

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: speckit-security-review-audit
Source: https://github.com/B0yZ4kr14/OrthoPlus-Enterprise/tree/main/.specify-backups/20260518-141826/_agents/skills/speckit-security-review-audit
Command: npx skills add https://github.com/B0yZ4kr14/OrthoPlus-Enterprise --skill speckit-security-review-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you perform a comprehensive security review of an entire codebase (or a clearly defined set of changed files) so you can catch vulnerabilities, architecture risks, and missing controls before milestone or release decisions.

Core Features & Use Cases

Broader/full security review: Validates security posture across multiple domains such as access control, misconfiguration, supply chain, injection, authentication, and cryptographic usage.
Changed-file driven scoping: Automatically detects changed files (when no explicit list is provided) and focuses findings on the most relevant audit surface.
Spec-Kit actionable output: Produces findings with OWASP/CWE mappings and generates Spec-Kit compatible remediation tasks to drive backlog follow-up.

Quick Start

Run the speckit-security-review-audit skill on the current repository to audit security risks across the codebase and generate prioritized, actionable remediation tasks.

Frequently Asked Questions about speckit-security-review-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I run a full codebase security audit before a major release?▼

A security audit for release validation checks vulnerabilities across access control, misconfiguration, supply chain, and injection. This Skill performs that comprehensive review and generates prioritized remediation tasks mapped to OWASP Top 10 and CWE.

What is changed-file driven scoping for threat modeling?▼

Changed-file driven scoping for threat modeling automatically detects modified files to focus security findings on the most relevant audit surface. It executes changed-file detection via the Spec-Kit script when no explicit file list is provided.

Can I audit only specific architecture trust boundaries instead of the whole project?▼

Yes, you can audit specific architecture trust boundaries by providing aspect or file constraints to limit the security review scope. This focuses findings on targeted DevSecOps controls without executing full codebase analysis.

How does OWASP Top 10 vulnerability mapping generate actionable remediation tasks?▼

OWASP Top 10 vulnerability mapping generates actionable remediation tasks by producing structured findings with CWE mappings and creating Spec-Kit compatible follow-up items. This drives your backlog by translating security risks into prioritized development tasks.

What are the limitations of automated dependency risk and supply chain reviews?▼

Automated dependency risk and supply chain reviews are limited by detected changed files or provided constraints, focusing findings on the defined audit surface. They validate DevSecOps controls but require file scoping to function effectively.