security-review

The security-review skill is an AI-powered codebase security scanner designed to emulate the reasoning process of a human security researcher. It analyzes code beyond simple pattern matching, tracing data flows, understanding component interactions, and identifying vulnerabilities that traditional static analysis tools often miss. The skill helps developers and security teams detect critical security issues early in the development cycle, covering injection flaws, access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic errors across multiple programming languages including JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.

Key capabilities of the security-review skill include comprehensive dependency audits to flag vulnerable packages, scanning for exposed secrets and sensitive credentials in code, and performing deep reasoning about code to detect complex security issues. It assigns severity ratings (CRITICAL, HIGH, MEDIUM, LOW, INFO) for each finding and proposes actionable patches, while always requiring human review before any fixes are applied. The skill is capable of following user input through multiple files, identifying risky data flows, and detecting misconfigurations or insecure practices in both code and configuration files.

This skill is ideal for developers, DevOps engineers, security teams, and code auditors who need to ensure the security of their applications. It is especially useful for projects written in supported languages where automated security checks are necessary to prevent vulnerabilities from reaching production. Typical use cases include scanning codebases for SQL injection, XSS, command injection, reviewing authentication and authorization logic, auditing dependencies for known CVEs, and checking for exposed API keys or hardcoded secrets. The skill can be invoked via commands or by natural language requests such as "is my code secure?" or "audit this codebase."