Agent skill · security · github
security-review
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.
Why this skill is useful
Adds a comprehensive security scanning capability that includes context-aware analysis and vulnerability detection scripts not available in standard tools.
What it needs
Requires python installed locally. About 5k tokens when loaded. Last updated 2026-08-07. 37,534 stars on the source repository.
What this skill does
Security Review An AI-powered security scanner that reasons about your codebase the way a human security researcher would — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. When to Use This Skill Use this skill when the request involves: Scanning a codebase or file for security vulnerabilities Running a security review or vulnerability check Checking for SQL injection, XSS, command injection, or other injection flaws Finding exposed API keys, hardcoded secrets, or credentials in code Auditing dependencies for known CVEs Reviewing authentication, authorization, or access control logic Detecting insecure cryptography or weak randomness Performing a data flow analysis to trace user input to dangerous sinks Any request phrasing like "is my code secure?", "scan this file", or "check my repo for vulnerabilities" Running /security-review or /security-review <path> How This Skill Works Unlike traditional static analysis tools that match patterns, this skill: 1. Reads code like a security researcher — understanding context, intent, and data flow 2. Traces across files — following how user input moves through your application 3. Self-verifies findings — re-examines each result to filter false positives 4. Assigns severity ratings — CRITICAL / HIGH / MEDIUM / LOW / INFO 5. Proposes targeted patches — every finding includes a concrete fix 6. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills github/security-review