# Security Reviewer

> Security vulnerability detection and remediation skill. Provides OWASP Top 10 checklists, secret scanning patterns, and security review methodology.

- Skill: `kumaran-is/security-reviewer` (Agent Skill, multi-file: 7 files)
- Install (CLI): `npx skillmds@latest add kumaran-is/security-reviewer`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kumaran-is/security-reviewer/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: kumaran-is (https://skillmd.com/u/kumaran-is)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/kumaran-is/security-reviewer

---


**Iron Law:** Never approve a security review with unresolved CRITICAL or HIGH findings; always escalate to the human before proceeding past a security gate.

# Security Review Skill

## Purpose

Provides security review methodology, vulnerability checklists, and remediation patterns for application code.

## Process

1. **Load checklist** -- Read the security review checklist for review categories and severity levels
2. **Scan code** -- Use Grep/Glob to find security-sensitive patterns
3. **Evaluate** -- Check each finding against the checklist
4. **Report** -- Output findings with severity and remediation guidance

For the complete security review checklist and methodology:

Read [reference/security-review-checklist.md](reference/security-review-checklist.md)

## Reference Files

| File | Content | Load When |
|------|---------|-----------|
| [reference/security-review-checklist.md](reference/security-review-checklist.md) | OWASP Top 10, secrets scanning, auth/authz, injection, data protection checklists | All security reviews |
| [reference/pci-dss-requirements.md](reference/pci-dss-requirements.md) | PCI DSS 12 requirements, compliance levels (L1-L4), SAQ types, prohibited data, audit log requirements, common violations | Any feature touching payment card data, payment processors, or billing |
| [reference/owasp-infrastructure-baseline.md](reference/owasp-infrastructure-baseline.md) | 15 OWASP-mapped infrastructure controls — encryption at rest/transit, IAM least-privilege, network hardening, audit logging, secret rotation | Any IaC review (Terraform, GCP, AWS), cloud config review, infrastructure security |
| [reference/agent-guardrails-checklist.md](reference/agent-guardrails-checklist.md) | 12-layer AI agent guardrail pipeline, prompt injection defense, output validation, async audit logging, Constitutional AI — agent-specific security controls | Any LangGraph agent, agentic AI service, or AI feature with tool use |
| [reference/claude-config-security.md](reference/claude-config-security.md) | Manual security audit checklist for `.claude/` config (settings.json, hooks, agents, MCP servers, CLAUDE.md) — workspace-specific allow/deny/ask list review, hook injection surface, MCP supply chain risks | Before committing any `.claude/` directory changes |

## Error Handling

If target files/directories don't exist, report "Target not found" with the paths searched.
If a scan produces no findings, report "No security issues detected" with scope of scan.