| name | security-reviewer |
| description | Security vulnerability detection and remediation skill. Provides OWASP Top 10 checklists, secret scanning patterns, and security review methodology. |
| allowed-tools | Read, Bash, Grep, Glob |
| agent | security-reviewer |
| context | fork |
| metadata | {"triggers":"security review, vulnerability, OWASP, security audit, injection, XSS, SSRF, secret scan, hardcoded secret","related-skills":"sast-configuration, threat-modeling, code-reviewer","domain":"security","role":"specialist","scope":"review","output-format":"report"} |
| last-reviewed | 2026-03-15 |
Iron Law: Never approve a security review with unresolved CRITICAL or HIGH findings; always escalate to the human before proceeding past a security gate.
Security Review Skill
Purpose
Provides security review methodology, vulnerability checklists, and remediation patterns for application code.
Process
- Load checklist -- Read the security review checklist for review categories and severity levels
- Scan code -- Use Grep/Glob to find security-sensitive patterns
- Evaluate -- Check each finding against the checklist
- Report -- Output findings with severity and remediation guidance
For the complete security review checklist and methodology:
Read reference/security-review-checklist.md
Reference Files
| File | Content | Load When |
|---|
| reference/security-review-checklist.md | OWASP Top 10, secrets scanning, auth/authz, injection, data protection checklists | All security reviews |
| reference/pci-dss-requirements.md | PCI DSS 12 requirements, compliance levels (L1-L4), SAQ types, prohibited data, audit log requirements, common violations | Any feature touching payment card data, payment processors, or billing |
| reference/owasp-infrastructure-baseline.md | 15 OWASP-mapped infrastructure controls — encryption at rest/transit, IAM least-privilege, network hardening, audit logging, secret rotation | Any IaC review (Terraform, GCP, AWS), cloud config review, infrastructure security |
| reference/agent-guardrails-checklist.md | 12-layer AI agent guardrail pipeline, prompt injection defense, output validation, async audit logging, Constitutional AI — agent-specific security controls | Any LangGraph agent, agentic AI service, or AI feature with tool use |
| reference/claude-config-security.md | Manual security audit checklist for .claude/ config (settings.json, hooks, agents, MCP servers, CLAUDE.md) — workspace-specific allow/deny/ask list review, hook injection surface, MCP supply chain risks | Before committing any .claude/ directory changes |
Error Handling
If target files/directories don't exist, report "Target not found" with the paths searched.
If a scan produces no findings, report "No security issues detected" with scope of scan.
