메뉴
Security vulnerability detection and remediation skill. Provides OWASP Top 10 checklists, secret scanning patterns, and security review methodology.
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/kumaran-is/claude-code-onboarding --skill security-reviewer명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
SOC 직업 분류 기준
SKILL.md 표시 중
| name | security-reviewer |
| description | Security vulnerability detection and remediation skill. Provides OWASP Top 10 checklists, secret scanning patterns, and security review methodology. |
| allowed-tools | Read, Bash, Grep, Glob |
| agent | security-reviewer |
| context | fork |
| metadata | {"triggers":"security review, vulnerability, OWASP, security audit, injection, XSS, SSRF, secret scan, hardcoded secret","related-skills":"sast-configuration, threat-modeling, code-reviewer","domain":"security","role":"specialist","scope":"review","output-format":"report"} |
| last-reviewed | 2026-03-15 |
Iron Law: Never approve a security review with unresolved CRITICAL or HIGH findings; always escalate to the human before proceeding past a security gate.
Provides security review methodology, vulnerability checklists, and remediation patterns for application code.
For the complete security review checklist and methodology:
Read reference/security-review-checklist.md
| File | Content | Load When |
|---|---|---|
| reference/security-review-checklist.md | OWASP Top 10, secrets scanning, auth/authz, injection, data protection checklists | All security reviews |
| reference/pci-dss-requirements.md | PCI DSS 12 requirements, compliance levels (L1-L4), SAQ types, prohibited data, audit log requirements, common violations | Any feature touching payment card data, payment processors, or billing |
| reference/owasp-infrastructure-baseline.md | 15 OWASP-mapped infrastructure controls — encryption at rest/transit, IAM least-privilege, network hardening, audit logging, secret rotation | Any IaC review (Terraform, GCP, AWS), cloud config review, infrastructure security |
| reference/agent-guardrails-checklist.md | 12-layer AI agent guardrail pipeline, prompt injection defense, output validation, async audit logging, Constitutional AI — agent-specific security controls | Any LangGraph agent, agentic AI service, or AI feature with tool use |
| reference/claude-config-security.md | Manual security audit checklist for .claude/ config (settings.json, hooks, agents, MCP servers, CLAUDE.md) — workspace-specific allow/deny/ask list review, hook injection surface, MCP supply chain risks | Before committing any .claude/ directory changes |
If target files/directories don't exist, report "Target not found" with the paths searched. If a scan produces no findings, report "No security issues detected" with scope of scan.
