skills.rest
tankpkg
tankpkgOFFICIAL
Explore all skills by this author →
GitHub

@tank/security-review

Identify exploitable security weaknesses in codebases, pull requests, and architectures.

1|1|Updated Feb 20, 2026
Search Tags:#owasp#threat modeling#security review#code audit#sast#secret detection#dependency scanning
One-click install
npx skills add https://github.com/tankpkg/packages --skill tank-security-review
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: @tank/security-review
Source: https://github.com/tankpkg/packages/tree/main/skills/security-review
Command: npx skills add https://github.com/tankpkg/packages --skill tank-security-review

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you perform high-confidence security reviews of code, pull requests, and architectures without drowning in speculative issues. It focuses on exploitable weaknesses that matter to developers and releases.

Core Features & Use Cases

  • Differential PR review: Assess changed files by risk, check dependencies and secrets, and report only actionable findings.
  • Full security audits: Map attack surfaces, threat model critical flows, run structured manual and automated analysis, and produce a report-ready output.
  • Coverage across common risks: OWASP Top 10, API security, SAST, dependency and supply chain issues, secrets, IaC misconfigurations, and language-specific vulnerability patterns.
  • Use case: Review a feature that touches authentication, payments, or user input and identify whether it introduces injection, access control, or data exposure problems.

Quick Start

Ask the Skill to review the attached PR or repository for exploitable security issues and return findings with severity, confidence, location, and remediation.

Frequently Asked Questions about @tank/security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a security review on a pull request without getting speculative issues?▼

Differential PR security review assesses changed files by risk, checks dependencies and secrets, and reports only actionable findings with high-confidence triage. It focuses on exploitable weaknesses that matter to releases.

What is the best way to audit a codebase for OWASP Top 10 and API security vulnerabilities?▼

Full security audits map attack surfaces, threat model critical flows, run structured manual and automated analysis, and produce report-ready output. They cover OWASP Top 10, API security, SAST, and supply chain issues.

Can I use this to scan for secrets and dependency supply chain issues in polyglot services?▼

Yes, security review applies to polyglot services and covers secret scanning, dependency scanning, and supply chain analysis. It identifies language-specific vulnerability patterns across web apps and APIs.

How does threat modeling work during a code audit for authentication and payment features?▼

Threat modeling during a code audit maps critical flows to identify injection, access control, or data exposure problems in features touching authentication or payments. It aligns findings with CWE and OWASP standards.

Does the security review cover Infrastructure as Code misconfigurations?▼

Yes, IaC review is a core feature that detects infrastructure as code misconfigurations. It applies targeted SAST analysis to identify exploitable weaknesses in your infrastructure definitions.

What severity and remediation details are included in the security findings?▼

Security findings include severity, confidence, location, and clear remediation guidance for confirmed issues. This high-confidence triage ensures developers receive actionable steps to fix exploitable weaknesses.

Related Skills

Explore More Software Engineering Skills→
josemlopezjosemlopez
8

tm-init

Analyze architecture documentation to generate asset inventories, data flows, trust boundaries, and attack surface mappings.

Community
Intermediate
erenisiklarerenisiklar

algorand-vulnerability-scanner

Detect 11 vulnerability patterns in Algorand TEAL/PyTeal smart contracts.

Community
Advanced
XerrionXerrion

pentest-sast

Identify SAST, dependency, secret, and supply-chain risks across source code and history.

Community
Advanced
TykoDevTykoDev
9

security-review

Perform risk-tiered security analysis with STRIDE and CWE/CVSS mappings.

Community
Advanced