# Review Application Security

> Application security review for attack paths and controls around identity, untrusted data, secrets, cryptography, injection, exposure, sensitive data, and exploitable dependencies. Use for secure-code, OWASP, or vulnerability-risk questions.

- Skill: `kenlck/review-application-security` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add kenlck/review-application-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kenlck/review-application-security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: kenlck (https://skillmd.com/u/kenlck)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/kenlck/review-application-security

---


# Review application security

Assess one repository, a repository group, or an existing fleet evidence bundle. Ground security claims in an attack path, control, or directly exposed sensitive asset.

## Run the lens

1. Read the [standalone lens protocol](../audit-software-fleet/references/standalone-lens.md) completely and prepare the supplied scope with lens ID `application-security`.
2. Read [the application security checks](references/checks.md) completely. Apply every check family relevant to the application type, exposure, data classification, and observed interfaces.
3. Trace untrusted inputs to security-sensitive operations and controls. Classify supported outcomes as strengths or findings; place missing reachability, deployment, or control evidence in unknowns and coverage.
4. Follow the protocol to account for every contract-registered check family, validate the result, ingest it, and hand back the canonical artifact path.

For raw collection, deep execution, refreshed advisories, or security scanners, read and follow the [safety model](../audit-software-fleet/references/safety-model.md). Redact secret evidence before persistence.

Read the [review basis](../audit-software-fleet/references/research-basis.md) when applying OWASP, NIST, CISA, EPSS, or OSV guidance. Read [scanner adapters](../audit-software-fleet/references/scanner-adapters.md) before interpreting tool output.

## Boundary

Own application attack paths and defensive controls. Route upstream support age to technology lifecycle and build, provenance, or artifact compromise paths to delivery and supply chain.

## Completion

**Complete when:** every in-scope repository has an exact commit or explicit unavailable state, every applicable check family is accounted for, every claim has bounded sanitized evidence at an appropriate confidence, gaps remain visible in unknowns and coverage, and the shared result validator succeeds.