security-reviewer

The security-reviewer skill is designed to identify and assess security vulnerabilities across codebases, infrastructure, and cloud environments. It addresses the critical need for systematic vulnerability detection and risk management, helping organizations proactively discover potential threats before they can be exploited. By producing structured audit reports, severity ratings, and actionable remediation guidance, this skill ensures that security weaknesses are not only identified but clearly communicated to relevant stakeholders for mitigation.

Key features of this skill include comprehensive scanning and review capabilities, such as static application security testing (SAST), dependency and secrets scanning, penetration testing, and cloud security analysis. It combines automated tools with manual review processes to ensure context-sensitive detection, rate findings using industry-standard severity levels (Critical, High, Medium, Low, Info), and prioritize remediation recommendations. Reports generated include executive summaries, detailed findings with locations and impacts, and prioritized action plans. It also provides reference guides for common vulnerabilities, secret detection, and secure coding practices.

This skill is primarily intended for security analysts, DevSecOps engineers, code reviewers, and cloud security specialists who need to conduct structured security audits or integrate vulnerability assessments into their workflows. Typical use cases include code reviews, penetration testing, dependency audits, secrets detection, and compliance checks within DevSecOps pipelines or cloud infrastructure. By leveraging this skill, teams can maintain a higher security posture, reduce risk exposure, and streamline the process of addressing identified vulnerabilities.