speckit-security-review-audit

Name: speckit-security-review-audit
Availability: InStock
Author: Numu

Audit repository changes for security vulnerabilities and generate remediation tasks.

2|Updated Jan 6, 2026

Search Tags:#code review #owasp #threat modeling #security audit #spec-kit #vulnerability analysis

Ready to run

npx skills add https://github.com/NUMU-IO/NUMU-api --skill speckit-security-review-audit-numu-io

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: speckit-security-review-audit
Source: https://github.com/NUMU-IO/NUMU-api/tree/main/.agents/skills/speckit-security-review-audit
Command: npx skills add https://github.com/NUMU-IO/NUMU-api --skill speckit-security-review-audit-numu-io

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps teams rapidly assess code changes for security vulnerabilities, architecture risks, and missing controls before they reach production.

Core Features & Use Cases

Full Security Review: Evaluates repositories against OWASP Top 10, secure coding practices, and DevSecOps configuration issues.
Actionable Reporting: Produces structured findings with severity, exploit scenarios, remediation guidance, and references.
Spec-Kit Alignment: Generates task-ready security remediation items and architecture security constraints for planning workflows.
Use Case: A security lead can review a pull request, identify access-control or injection risks, and turn the results into prioritized engineering tasks.

Quick Start

Use this Skill to audit the current repository or a set of changed files and generate a complete security review report with remediation tasks.

Frequently Asked Questions about speckit-security-review-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit repository changes for security vulnerabilities before production?▼

A security audit assesses repository changes against OWASP Top 10 guidelines to identify access-control flaws, injection risks, and architecture issues. It produces structured findings with severity ratings, exploit scenarios, and remediation guidance for engineering teams.

What is threat modeling and vulnerability analysis in a code review?▼

Threat modeling and vulnerability analysis in code review evaluate exploitability of security risks in changed files. They assess attack scenarios, identify missing DevSecOps controls, and provide remediation references based on secure coding practices.

How do I generate security remediation tasks from a pull request scan?▼

Generating security remediation tasks from a pull request scan involves evaluating changed files for vulnerabilities and producing task-ready items. The output includes prioritized engineering tasks with remediation guidance and architecture security constraints for planning workflows.

Does this security audit work for both full-project reviews and scoped assessments?▼

Yes, this security audit applies to full-project reviews, pull-request scans, and scoped assessments of changed files. It evaluates repositories against OWASP Top 10, secure coding practices, and DevSecOps configuration issues regardless of review scope.

What's the best way to assess exploitability of code risks during a security audit?▼

Assessing exploitability of code risks during a security audit involves evaluating identified vulnerabilities against OWASP-based analysis to determine severity. It generates structured findings with exploit scenarios, remediation guidance, and security constraint outputs.

Can I use Spec-Kit task generation to turn security review findings into engineering tasks?▼

Yes, Spec-Kit task generation converts security review findings into task-ready remediation items and architecture security constraints. This allows security leads to turn identified access-control or injection risks into prioritized engineering tasks for planning workflows.

outfitter-dev

security-engineering

Audit codebases for security vulnerabilities and misconfigurations using OWASP and CWE mappings.

Official

Advanced

pradeepmouli