Results for “security-review”

Scaffolds and reviews custom WordPress REST API endpoints, covering registration, authorization, input validation, response shaping, and security best practices.

OWASP Top 10 audit checklists for Web Applications (2021), APIs (2023), and Mobile (2024). Use when performing any security review, PR review, or codebase audit touching web, mobile, or API code.

Build, review, and refactor Java backend services (Spring Boot). Use for tasks like REST API design, controllers/services/repositories, PostgreSQL persistence (JPA/MyBatis), migrations, configuration, security (Spring Security), observability, testing, performance tuning, and production hardening.

Code review is time-consuming and inconsistent. Reviewers miss security issues, overlook edge cases, or focus on style over substance. Meanwhile, AI agents catch these mechanical issues instantly but can't judge business logic correctness, UX decisions, or architectural fit.

Enforces OWASP Top 10:2025 compliance on code touching security-relevant domains, using cached cheat sheets and verifying fixes against OSV.dev.

Audits codebases for common security vulnerabilities that AI coding assistants introduce in "vibe-coded" applications. Checks for exposed API keys, broken access control (Supabase RLS, Firebase rules), missing auth validation, client-side trust issues, insecure payment flows, and more. Use this skill whenever the user asks about security, wants a code review, mentions "vibe coding", or when you're writing or reviewing code that handles authentication, payments, database access, API keys, secrets, or user data — even if they don't explicitly mention security. Also trigger when the user says things like "is this safe?", "check my code", "audit this", "review for vulnerabilities", or "can someone hack this?".

Audits Rust codebases for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS, FFI safety, and async runtime mistakes.

I'm ready to help you review code changes on your branch for bugs, security vulnerabilities, and code quality issues.

Performs a white-box source code security review structured around OWASP ASVS 5.0, mapping attack surfaces, tracing data flows, and chaining into downstream penetration testing and threat modeling skills.

Finds gaps between documented intent and actual implementation in codebases, catching bugs that generic scanners miss because they lack a model of intent.

Enforces output quality, intellectual honesty, and continuous improvement across security analysis agents with anti-rationalization guards, self-critique loops, retry protocols, and quality gates.

Review pull requests or audit repositories for correctness, security, performance, test risk, architecture, dependencies, developer experience, documentation, and grounded product direction. Use for code review, repository audits, evidence-backed findings, false-positive vetting, risk assessment, prioritization, or deciding which improvements should become implementation plans.

Runs a six-phase security audit covering attack-surface mapping, STRIDE/PASTA threat modeling, technical checklists, red/blue team exercises, and a final verdict, plus incident-response and monitoring guidance.

Runs a structured security audit across six phases: attack-surface mapping, STRIDE/PASTA threat modeling, technical checklists, red/blue team analysis, and a final verdict, with optional Python automation scripts.

Prepares codebases for security review using Trail of Bits' checklist by setting review goals, running static analysis, increasing test coverage, removing dead code, and generating documentation.

Review generated code for style, security, and architecture issues; suggest refactorings and performance improvements. Use after implementation is complete, before merging changes, or when refactoring existing code. Follows OWASP guidelines, SOLID principles, and best practices for maintainable code.

Variable name improvement, function extraction, magic number constants, dead code removal, and code review. For refactoring and PR review — does not change behavior. Don't use for bug/security (Judge), new tests (Radar), architecture (Atlas), or feature implementation (Builder).

Runs a structured 6-phase security audit covering attack-surface mapping, STRIDE/PASTA threat modeling, technical checklists, red/blue team exercises, and a final verdict, plus incident-response and monitoring playbooks.

当一段改动已经写完、要在收尾或合并前对它做一次独立审查时使用——如"审一遍这条分支、review 这次改动、这批代码有没有问题、帮我把关再合"。先把 BASE..HEAD 生成一份审查包一次读完，再按 correctness / readability / architecture / security / performance 五轴加测试质量逐项判定，输出带 file:line 的 Critical / Important / Minor 分级 findings。composable 层能力单元，通常由 execute-task 在整体验收时调用。不要用于：改动还没写完、只想跑测试、要的是动手修复而不是审查、评审需求或技术方案本身。

Review whether a product, MVP, or feature is actually ready to launch. Use when the team needs a production-minded check across product quality, UX edge cases, auth and security, observability, support readiness, pricing readiness, and post-launch measurement.

Host security hardening and risk-tolerance configuration for SolanaOS deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure review, SolanaOS cron scheduling for periodic checks, or version status checks on a machine running SolanaOS (laptop, workstation, Pi, VPS).

Host security hardening and risk-tolerance configuration for OpenClaw deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure review, OpenClaw cron scheduling for periodic checks, or version status checks on a machine running OpenClaw (laptop, workstation, Pi, VPS).

Find over-permissive RBAC roles and service-account token abuse paths in Kubernetes using kubectl auth can-i, rbac-police, kubectl-who-can, and rakkess during authorized cluster security reviews.

Guides HIPAA-specific healthcare privacy and security work, routing to implementation and review skills with decision gates and guardrails.

Run the Legal Builder Hub security-review gate on a candidate legal skill — inspect its manifest and body for unsafe behavior before any install is allowed.

AI-powered Claude Code skill that performs deep code review using formal logic and reasoning frameworks to detect bugs, anti-patterns, and security risks beyond what linters catch.

Authorized security assessment for cloud, container, and Kubernetes environments covering metadata SSRF, IAM misconfigurations, container escape paths, and cluster RBAC review.

Guides Stripe integration decisions: API selection, Connect platform setup, billing, Treasury, and security best practices for building or reviewing Stripe integrations.

Security audit skill — systematic OWASP + STRIDE review of a project. Covers attack surface, secrets archaeology, dependency supply chain, OWASP Top 10, threat modeling, and false-positive filtering. Outputs a prioritized findings report.

Creates comprehensive GitHub pull requests with automated quality validation and security scanning, then hands off to /github:review-pr for CI monitoring and reviewer-comment triage. This skill should be used when the user asks to "create a PR", "submit a pull request", or needs to merge completed work with full compliance checks.

Assesses codebase maturity using Trail of Bits' 9-category framework, producing a professional scorecard with evidence-based ratings and actionable recommendations.

Designs and implements backend systems including REST APIs, microservices, database architectures, authentication flows, and security hardening. Use when the user asks to "design REST APIs", "optimize database queries", "implement authentication", "build microservices", "review backend code", "set up GraphQL", "handle database migrations", or "load test APIs". Covers Node.js/Express/Fastify development, PostgreSQL optimization, API security, and backend architecture patterns.

Runs a comprehensive verification pipeline for Quarkus projects including build, static analysis, tests with coverage, security scans, native compilation, and diff review before PRs or releases.

Reviews and hardens GitHub Actions workflows against injection, privilege escalation, supply-chain, and token-scoping risks that pattern matchers miss.

Use this skill for SBOM, SCA, lockfile review, provenance, package integrity, supply-chain risk. Trigger when the task involves security work related to Supply Chain SBOM SCA, implementation, audits, debugging, strategy, or validation.

Information Security Management System (ISMS) audit expert for ISO 27001 compliance verification, security control assessment, and certification support. Use when the user mentions ISO 27001, ISMS audit, Annex A controls, Statement of Applicability (SOA), gap analysis, nonconformity management, internal audit, surveillance audit, or security certification preparation. Helps review control implementation evidence, document audit findings, classify nonconformities, generate risk-based audit plans, map controls to Annex A requirements, prepare Stage 1 and Stage 2 audit documentation, and support corrective action workflows.