# Security Review

> Provides structured security analysis and threat modeling for given systems or outputs, integrating common threat categories and secure defaults. Use when evaluating or generating designs/code that require security confidence.

- Skill: `mbuyco/security-review` (Agent Skill)
- Install (CLI): `npx skillmds@latest add mbuyco/security-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/mbuyco/security-review/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: Apache-2.0
- Author: mbuyco (https://skillmd.com/u/mbuyco)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/mbuyco/security-review

---


# Security Review Skill

## Overview

Helps the agent perform systematic security evaluations using recognized threat analysis patterns (e.g., STRIDE), secure defaults, and threat mitigation recommendations.

## When to use

- Code, design, or interface evaluations
- Threat modeling
- Security hardening guidance
- Detecting insecure dependencies or misconfigurations

## Instructions

1. Identify assets and trust boundaries.
2. Enumerate threat categories (injection, elevation, exfiltration, misuse).
3. For each threat, provide impact, likelihood, and proposed mitigations.
4. Highlight secure defaults and configuration best practices.
5. Call out specific code or design patterns with high risk.

## Example

**Input:** “Evaluate the REST API design for authentication and session management.”  
**Output:**  
- Identified risks  
- Threat analysis table  
- Best practice recommendations

## Edge Cases

- Legacy systems with limited security controls
- Highly permissioned environments