Security Reviewer
Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance.
Before & after
Same prompt, same agent — the only difference is the skill.
I can help review your code for security issues. There are many potential vulnerabilities to look for — things like SQL injection, cross-site scripting, insecure dependencies, hardcoded secrets, and more. The audit will depend on your tech stack, deployment model, and what data you're handling. I'd recommend checking your dependencies, reviewing authentication logic, and making sure secrets aren't in version control. Would you like me to focus on any particular area, or should I do a general review?
SECURITY AUDIT REPORT DEPENDENCY SCAN Package vulnerabilities found: 3 • lodash-4.17.19 → CRITICAL (Prototype Pollution) → Upgrade to 4.17.21+ • express-session-1.16.0 → HIGH (Session Fixation) → Upgrade to 1.17.3+ • debug-3.1.0 → MEDIUM (Regular Expression DoS) → Upgrade to 4.3.1+ CRYPTO & AUTH • Password hashing: bcrypt rounds=10 (PASS) • JWT secret in .env (PASS - not in code) • Session store using memory — FAIL: Move to Redis with 24h expiry • No CSRF token on state-changing endpoints (POST/PUT) — FAIL: Add token middleware API & INJECTION • SQL queries: using parameterized statements (PASS) • File upload: no extension whitelist (FAIL): Add .jpg, .png, .pdf only • API rate limit: none detected (FAIL): Add token bucket at 100 req/min per IP INFRASTRUCTURE • Secrets in environment: PASS • CORS: wildcard origin detected (FAIL): Restrict to known domains only • HTTP headers: Missing X-Content-Type-Options, CSP (FAIL): Add security headers middleware REMEDIATION PRIORITY 1. Add CSRF middleware (1 hour) 2. Restrict CORS origins (30 min) 3. Upgrade dependencies (2 hours including test) 4. Migrate sessions to Redis (4 hours) 5. Implement rate limiting (2 hours) Note: This is a structural audit, not a penetration test. Engage a professional security team for sensitive systems.
About this skill
name: security-reviewer description: Use when Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance.
Security Reviewer
Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists.
What you get
- Public GitHub repo
- the skills/security-reviewer folder with SKILL.md and references.
Customize your output
- Fork the repo and extend the skill's reference files for your own stack conventions.
Example output
Activates on a matching request (e.g. building or reviewing Security Reviewer code) and can chain with other skills in the pack.
Best for
Full-stack developers and engineering teams using Claude Code.
SKILL.md preview
---
name: security-reviewer
description: Use this skill to identify security vulnerabilities, generate a structured audit report with severity ratings, and give actionable remediation guidance.
version: 1.0.0
category: Development / Security
author: AgentVolt
license: proprietary
tags:
- development
- security
---
# Security Reviewer
Conducts a structured security review of code or infrastructure and produces an audit report with severity ratings and concrete remediation steps.
## When to use
… (sign up to view the full skill)More development skills
View all Development skills →Security Scanning
Scans code changes for common security issues before they ship.
Secure Code Guardian
Implements authentication, authorization, and input validation with concrete secure defaults, preventing OWASP Top 10 vulnerabilities in new code.
Fullstack Guardian
Builds security-focused full-stack web applications by implementing integrated frontend and backend components with layered security at every level.
Trail of Bits Security Skill
Audits your code for security issues before you ship, using Trail of Bits' professional security review methodology.