claude-code-security-review

Perform security audits on code changes, diffs, or branches to find high-confidence exploitable vulnerabilities. Use when asked to "audit security", "review for vulnerabilities", "security scan", "check for security issues", "audit this PR", "review these changes for security", or "find vulnerabilities in diff". Distinct from security-review (which provides secure coding patterns/checklists) — this skill actively audits code changes using a structured methodology with false positive filtering. Includes Python scripts for GitHub Action CI integration and PR evaluation.

Create, update, or validate SKILL.md files and skill packages. Use this skill when users ask to "create a skill", "make a new skill", "add a skill", "write a skill", "update a skill", "validate skill", "check skill quality", "review skill", "audit skills", or work with .claude/skills/ directory contents. Supports three operations: (1) CREATE - new skill from scratch, (2) UPDATE - modify existing skill, (3) VALIDATE - audit skill against SkillsBench best practices. NOT for UI/frontend design work - only for authoring skill definition files that extend Claude's capabilities.

Fetch real, current API docs and verify package versions before installing packages, calling external APIs, using SDKs, or integrating any third-party library. Triggers on npm install, pip install, package.json changes, import statements for external packages, API calls (fetch, axios, SDK methods), "integrate with", "connect to", "use X library", or debugging silent API failures where code returns 200 but produces no effect.