security-review

Stars8

Forks2

UpdatedFebruary 16, 2026 at 10:39

Run an OWASP-focused security analysis on code changes.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Source

bis-code

bis-code/claude-toolkit

View GitHub Repository View Creator Repositories

Download

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

name	security-review
description	Run an OWASP-focused security analysis on code changes.

/security-review

Spawns the security-reviewer agent to perform a structured security analysis of your code changes.

Steps

Gather context — detect the scope of the security review:
- If arguments are provided (file paths or PR number), scope to those
- Otherwise, use git diff to determine changed files
- Identify files touching auth, API endpoints, input handling, or secrets
Spawn the agent — use the Task tool:
```
Task tool with subagent_type="security-reviewer"
```
Pass in the prompt:
- The diff or file contents to review
- The list of changed files with categories (auth, API, data handling)
- The project's language and framework for context-specific checks
Present findings — relay the agent's security report:
- Group by severity: CRITICAL > HIGH > MEDIUM > LOW
- Include exploit scenarios for each finding
- Show recommended fixes with code references
- Report secrets detection and dependency audit results
Offer follow-up actions:
- "Fix critical issues?" — apply recommended security fixes
- "Create issues for non-critical findings?" — track as GitHub issues
- "Run dependency audit?" — check for known CVEs in dependencies

More from this repository

same repository

agent-creator

bis-code/claude-toolkit

Interactive agent builder: guides the user through defining a new agent as a behavioral spec, then generates the agent .md and installs it.

2026-05-298

deep-dive

bis-code/claude-toolkit

Cross-repo investigation: research planning issues, break down into sub-issues, generate ralph session prompts per repo.

2026-05-298

bis-code/claude-toolkit

Three-phase QA orchestrator: parallel scan, interactive triage, guided fix.

2026-05-298

ralph

bis-code/claude-toolkit

Interactive feature builder with subagent delegation and approval gates.

2026-05-298

rule-creator

bis-code/claude-toolkit

Interactive rule builder: guides the user through defining a new rule as a constraint doc, then generates the rule .md and installs it.

2026-05-298

skill-creator

bis-code/claude-toolkit

Interactive skill builder: guides the user through defining a new skill as a structured SOP, then generates the SKILL.md and installs it.

2026-05-298

name	security-review
description	Run an OWASP-focused security analysis on code changes.

/security-review

Spawns the security-reviewer agent to perform a structured security analysis of your code changes.

Steps

Gather context — detect the scope of the security review:
- If arguments are provided (file paths or PR number), scope to those
- Otherwise, use git diff to determine changed files
- Identify files touching auth, API endpoints, input handling, or secrets
Spawn the agent — use the Task tool:
```
Task tool with subagent_type="security-reviewer"
```
Pass in the prompt:
- The diff or file contents to review
- The list of changed files with categories (auth, API, data handling)
- The project's language and framework for context-specific checks
Present findings — relay the agent's security report:
- Group by severity: CRITICAL > HIGH > MEDIUM > LOW
- Include exploit scenarios for each finding
- Show recommended fixes with code references
- Report secrets detection and dependency audit results
Offer follow-up actions:
- "Fix critical issues?" — apply recommended security fixes
- "Create issues for non-critical findings?" — track as GitHub issues
- "Run dependency audit?" — check for known CVEs in dependencies