security-reviewer

Use it when:: You want a security audit of a codebase or its infrastructure, such as a dependency or secrets scan or a compliance check.
It does:: Maps the attack surface, runs code, dependency and secret scanners, reviews auth, input handling and crypto by hand, then rates each finding.
You get:: An executive summary, a findings table by severity, and each finding with its file and line, impact and fix, plus prioritized recommendations.
Asks first:: For written authorization and rules of engagement before it starts and again before active testing, and confirms findings with you before the report is final.
Unlike code-reviewer:: That one, from the same repo, is a broad one-pass review; this one covers security alone and runs scanning tools.
Needs:: The scanners it runs, such as semgrep, bandit, gitleaks, npm audit and trivy.

Expects scanners such as Semgrep, Bandit, Gitleaks and Trivy to be installed. Its steps include penetration testing: use it only on systems you own or are authorized to test.

TL;DR

It works as a security analyst who runs automated tools first and still reviews by hand, since tools miss context. Its example commands are `semgrep --config=auto`, `bandit`, `gitleaks detect`, `npm audit` and `trivy fs`. Severity runs from Critical to Info by CVSS, a standard 0 to 10 score of how serious a vulnerability is, and low-severity findings aren't ignored. Exploits stop at a proof of concept; it won't test production without authorization, go outside the agreed scope, cause disruption or data loss, or share detailed exploits publicly. Critical findings are reported at once. Its example finding is a SQL injection with file and line, impact, the parameterized-query fix and CWE and OWASP references. Reference files cover scanning tools, vulnerability patterns such as SQL injection and XSS, secret scanning, penetration testing, infrastructure and cloud security with compliance, and a report template.

Summarizes the skill at 078a25c.

npx skills add https://github.com/jeffallan/claude-skills --skill security-reviewer

skills.sh page Source on GitHub All skills from jeffallan/claude-skills

Total Downloads: 6,500 on skills.sh, Nov 9, 2026
Repo stars: 12,279 jeffallan/claude-skills
First seen: Jan 20, 2026 on skills.sh

Weekly Downloads

181

+36% over the 8 weeks to Nov 9

Weekly values

Week to	Installs
Sep 21	133
Sep 28	134
Oct 5	126
Oct 12	136
Oct 19	204
Oct 26	192
Nov 2	251
Nov 9	181

Category	category:security category:debugging category:software-engineering Compliance, guardrails, skill vetting and browser fingerprinting. Find root causes, review code and test what you built. Everything for building software: planning, coding, debugging, design, frameworks, cloud, agents and skills.
Type	type:workflow A multi-step process the agent follows: interview, debug, run a TDD loop, review.
Effect	effect:none Adds no side effects of its own. It shapes how the agent thinks, writes or reviews. Guidelines and routers are always effect:none, even when the task they support edits code.
Needs	needs:cli A specific command-line tool or desktop app must be installed, such as gh, agent-browser, LibreOffice, Obsidian or a vendor CLI.
Publisher	by:community Everyone else. Unverified vendor claims default to community.
Topics	security code-review

SKILL.md

From jeffallan/claude-skills at 078a25c. Checked daily, last changed Nov 6, 2026.

Frontmatter

name: security-reviewer
description: Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists.
license: MIT
allowed-tools: Read Grep Glob
metadata:
  author: https://github.com/Jeffallan
  company: https://synergetic.solutions
  version: "1.1.1"
  domain: security
  triggers: security review, vulnerability scan, SAST, security audit, penetration test, code audit, security analysis, infrastructure security, DevSecOps, cloud security, compliance audit
  role: specialist
  scope: review
  output-format: report
  related-skills: secure-code-guardian, code-reviewer, devops-engineer, cloud-architect, kubernetes-specialist, api-designer, mcp-developer

Security Reviewer

Security analyst specializing in code review, vulnerability identification, penetration testing, and infrastructure security.

When to Use This Skill

Code review and SAST scanning
Vulnerability scanning and dependency audits
Secrets scanning and credential detection
Penetration testing and reconnaissance
Infrastructure and cloud security audits
DevSecOps pipelines and compliance automation

Core Workflow

Scope — Map attack surface and critical paths. Confirm written authorization and rules of engagement before proceeding.
Scan — Run SAST, dependency, and secrets tools. Example commands:
- semgrep --config=auto .
- bandit -r ./src
- gitleaks detect --source=.
- npm audit --audit-level=moderate
- trivy fs .
Review — Manual review of auth, input handling, and crypto. Tools miss context — manual review is mandatory.
Test and classify — Verify written scope authorization before active testing. Validate findings, rate severity (Critical/High/Medium/Low/Info) using CVSS. Confirm exploitability with proof-of-concept only; do not exceed it.
Report — Confirm findings with stakeholder before finalizing. Document with location, impact, and remediation. Report critical findings immediately.

Reference Guide

Load detailed guidance based on context:

Topic	Reference	Load When
SAST Tools	`references/sast-tools.md`	Running automated scans
Vulnerability Patterns	`references/vulnerability-patterns.md`	SQL injection, XSS, manual review
Secret Scanning	`references/secret-scanning.md`	Gitleaks, finding hardcoded secrets
Penetration Testing	`references/penetration-testing.md`	Active testing, reconnaissance, exploitation
Infrastructure Security	`references/infrastructure-security.md`	DevSecOps, cloud security, compliance
Report Template	`references/report-template.md`	Writing security report

Constraints

MUST DO

Check authentication/authorization first
Run automated tools before manual review
Provide specific file/line locations
Include remediation for each finding
Rate severity consistently
Check for secrets in code
Verify scope and authorization before active testing
Document all testing activities
Follow rules of engagement
Report critical findings immediately

MUST NOT DO

Skip manual review (tools miss things)
Test on production systems without authorization
Ignore "low" severity issues
Assume frameworks handle everything
Share detailed exploits publicly
Exploit beyond proof of concept
Cause service disruption or data loss
Test outside defined scope

Output Templates

Executive summary with risk assessment
Findings table with severity counts
Detailed findings with location, impact, and remediation
Prioritized recommendations

Example Finding Entry

ID: FIND-001
Severity: High (CVSS 8.1)
Title: SQL Injection in user search endpoint
File: src/api/users.py, line 42
Description: User-supplied input is concatenated directly into a SQL query without parameterization.
Impact: An attacker can read, modify, or delete database contents.
Remediation: Use parameterized queries or an ORM. Replace `cursor.execute(f"SELECT * FROM users WHERE name='{name}'")`
             with `cursor.execute("SELECT * FROM users WHERE name=%s", (name,))`.
References: CWE-89, OWASP A03:2021

Knowledge Reference

OWASP Top 10, CWE, Semgrep, Bandit, ESLint Security, gosec, npm audit, gitleaks, trufflehog, CVSS scoring, nmap, Burp Suite, sqlmap, Trivy, Checkov, HashiCorp Vault, AWS Security Hub, CIS benchmarks, SOC2, ISO27001

Maintained by @jeffallan, Principal Consultant at Synergetic Solutions

Documentation