Agent skill · security · jeremylongshore
performing-security-code-review
Execute this skill enables AI assistant to conduct a security-focused
Why this skill is useful
Adds specific vulnerability scanning patterns and remediation guidance that the AI wouldn't reliably generate on its own.
What it needs
Requires grep installed locally. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Performing Security Code Review Overview Conducts security-focused code reviews by scanning source files for common vulnerability patterns including SQL injection, XSS, authentication flaws, insecure dependencies, and secret exposure. Produces structured severity-rated reports with specific remediation guidance. Prerequisites Read access to all source files in the target project grep available on PATH for pattern matching Access to package.json or equivalent dependency manifest for dependency auditing Familiarity with OWASP Top 10 vulnerability categories Instructions 1. Identify the scope of the review: specific files, directories, or the entire codebase. Confirm the primary language(s) and framework(s) in use. 2. Scan for hardcoded secrets and credentials: Search for patterns matching API keys, tokens, passwords, AWS access keys (AKIA...), and private key headers (BEGIN PRIVATE KEY). Flag any .env files or configuration files containing plaintext secrets. 3. Analyze code for injection vulnerabilities: Identify raw SQL string concatenation (SQL injection risk). Locate unsanitized user input rendered in HTML (XSS risk). Check for eval(), exec(), or Function() calls with dynamic input (code injection risk). 4. Review authentication and authorization logic: Verify password hashing uses strong algorithms (bcrypt, argon2) rather than MD5/SHA1. Check for missing authentication on sensitive endpoints. Identify overly permissive CORS configurations. 5. Audit dependencies for known vulnerabilities: Run npm audit or equivalent package manager audit command. Cross-reference dependency versions against known CVE databases. 6. Check for insecure communication patterns: Flag HTTP URLs where HTTPS is expected. Identify disabled TLS certificate verification. 7. Compile findings into a structured report sorted by severity (Critical, High, Medium, Low), including the vulnerable code location, explanation, and remediation steps. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/performing-security-code-review--298c54