speckit-security-review-audit

Identify and document security vulnerabilities with prioritized remediation guidance.

2|Updated Jan 29, 2026

Search Tags:#security #owasp #threat-modeling #devsecops #spec-kit #code-review #risk-analysis

Ready to run

npx skills add https://github.com/pradeepmouli/lspeasy --skill speckit-security-review-audit-pradeepmouli

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: speckit-security-review-audit
Source: https://github.com/pradeepmouli/lspeasy/tree/main/.github/skills/speckit-security-review-audit
Command: npx skills add https://github.com/pradeepmouli/lspeasy --skill speckit-security-review-audit-pradeepmouli

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Perform a comprehensive security review of the current codebase to identify vulnerabilities, misconfigurations, and architectural risks, and to produce prioritized, actionable remediation guidance aligned with Spec-Kit's task-tracking system.

Core Features & Use Cases

Comprehensive security assessment across code, configurations, dependencies, and infrastructure as code.
Generates actionable findings with severity, exploit scenarios, remediation steps, and STRIDE-based threat modeling.
Integrates with Spec-Kit workflow to produce import-ready remediation tasks and align with development sprints.

Quick Start

Run the security review against the repository to generate a Spec-Kit ready task list.

Frequently Asked Questions about speckit-security-review-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate a security review for my codebase and generate remediation tasks?▼

Automate a security review by running an assessment across your codebase, dependencies, and infrastructure as code to identify vulnerabilities and output prioritized remediation tasks.

What is STRIDE-based threat modeling and how does it apply to codebase security?▼

STRIDE-based threat modeling categorizes architecture risks into spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege to structure your codebase security findings.

Can I use Spec-Kit to track and prioritize security vulnerabilities found during a code review?▼

Yes, you can use Spec-Kit to track security vulnerabilities by generating import-ready tasks from your code review that include severity levels, exploit scenarios, and actionable fixes for your development sprints.

Does this security audit cover infrastructure as code and dependency misconfigurations?▼

Yes, the security audit comprehensively covers infrastructure as code and dependency misconfigurations, applying risk analysis across all project components to document architecture risks and vulnerabilities.

What is the best way to document exploit scenarios and remediation steps for OWASP vulnerabilities?▼

The best way to document OWASP vulnerabilities is to generate structured findings that pair severity ratings with specific exploit scenarios, STRIDE threat categories, and actionable remediation guidance.