Secure Code Review Pipeline
curated by SkillMD · plugin · 12 skills
Installs a pipeline to validate, plan, execute, and enforce a secure code review on PRs.
Install the whole plugin (CLI)
npx skillmds add addyosmani/security-and-hardening
npx skillmds add getsentry/find-bugs
npx skillmds add alirezarezvani/pr-review-expert
npx skillmds add antigravity/fix-review
npx skillmds add cloudflare-security-audit/security-audit
npx skillmds add deep-chavda/ai-engineering-standards
npx skillmds add zhaoxuya520/code-audit
npx skillmds add zhaoxuya520/api-security
npx skillmds add zhaoxuya520/dotnet-reverse
npx skillmds add zhaoxuya520/identity-federation
npx skillmds add zhaoxuya520/supply-chain-security
npx skillmds add shulkwisec/xxeSkills in this plugin
- ▌ security-and-hardening · addyosmaniHardens code against vulnerabilities by applying threat modeling, OWASP Top 10 prevention patterns, and secure coding practices for web applications.
- ▌ find-bugs · getsentryReviews local branch changes for bugs, security vulnerabilities, and code quality issues using a structured checklist and attack surface mapping.
- ▌ pr-review-expert · alirezarezvaniReview GitHub PRs and GitLab MRs with structured analysis including blast radius, security scanning, test coverage delta, breaking change detection, and performance impact.
- ▌ fix-review · antigravityVerifies that fix commits properly address security audit findings without introducing new bugs or vulnerabilities.
- ▌ security-audit · cloudflare-security-audit bundleFinds exploitable vulnerabilities in codebases through a structured multi-phase audit covering recon, hunting, validation, and reporting.
- ▌ ai-engineering-standards · deep-chavdaEnforces production-grade Python and AI engineering standards for FastAPI, LangChain/LangGraph, RAG pipelines, and LLM integrations, covering type safety, error handling, testing, and security.
- ▌ code-audit · zhaoxuya520 bundlePerforms authorized source-code security reviews using SAST tools like Semgrep and CodeQL, with manual verification of findings and fix recommendations.
- ▌ api-security · zhaoxuya520 bundleAuthorized security assessment of REST, GraphQL, WebSocket, and SOAP APIs covering discovery, authentication, authorization, rate-limiting, and CI/CD integration.
- ▌ dotnet-reverse · zhaoxuya520 bundleProvides a structured workflow for reverse engineering .NET and C# binaries, including deobfuscation with de4dot, static analysis via dnSpyEx IL view, dynamic debugging, and reliable IL patching for red-team tools and malware.
- ▌ identity-federation · zhaoxuya520 bundleAuthorized assessment of federated identity systems covering SAML, OIDC, and OAuth2 flows, SSO misconfigurations, and token confusion issues.
- ▌ supply-chain-security · zhaoxuya520 bundleAssess software supply chain security by generating SBOMs, scanning dependencies, auditing CI/CD pipelines, analyzing container images, and verifying vulnerability reachability.
- ▌ xxe · shulkwisecDetect and exploit XML External Entity (XXE) injection vulnerabilities in XML parsers, including file disclosure, SSRF, and blind out-of-band exfiltration.