How do I install the Code Review Security skill?

Run npx skillmds@latest add owasp/code-review-security in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Code Review Security safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Code Review Security?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Code Review Security free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under CC-BY-4.

Who published Code Review Security?

OWASP (@owasp) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Code Review Security by owasp — Agent Skill

Name: Code Review Security
Author: OWASP

Code Review Security

Security-focused code review mapped to OWASP Top 10 and ASVS. Use when reviewing pull requests, auditing files or modules for vulnerabilities, or performing pre-merge security gate checks. Covers injection, auth, authorization, cryptography, data exposure, misconfiguration, and deserialization.

OWASP 63831d0 2.2 KB Updated Sep 17, 2026

File contents

Security Code Review

Review code for security vulnerabilities by following the full procedure in plays/code-review-security.md.

Steps

Scope & Context — Establish language/framework, trust boundary (server/client/library/CLI), data sensitivity (PII, credentials, financial), and exposure (internet-facing, internal, local).
Systematic Review by Vulnerability Class (priority order):
- Injection (A03) — SQL, command, XSS, SSTI, LDAP, path traversal, header, log injection
- Authentication & Session (A07) — Hardcoded credentials, missing auth, weak sessions, JWT issues
- Authorization (A01) — Missing authz checks, IDOR, horizontal/vertical privilege escalation
- Cryptography (A02) — Weak algorithms, hardcoded keys, missing encryption, custom crypto
- Data Exposure (A01) — Sensitive data in errors/logs, credentials in code, debug mode
- Misconfiguration (A05) — Default credentials, permissive CORS, missing security headers
- Deserialization (A08) — Untrusted deserialization, missing integrity checks, CSRF gaps
Framework-Specific Checks — Apply checks for detected framework (React, Express, Django, Flask, Spring, Rails, Go).
Diff-Specific Analysis (for PRs) — Focus on changed lines plus context, verify security controls preserved, check new endpoints match auth patterns, look for removed security controls.
Produce Findings — Cite file:line, show vulnerable snippet, explain attack scenario, provide fixed code, rate confidence.

Output

Scope summary, findings sorted by severity using templates/finding.md, positive observations (good security controls in place), and severity count table.

OWASP References

OWASP Top 10 (2021): A01-A10
OWASP ASVS v5.0
OWASP Code Review Guide
OWASP Cheat Sheet Series

---name: code-review-securitydescription: Security-focused code review mapped to OWASP Top 10 and ASVS. Use when reviewing pull requests, auditing files or modules for vulnerabilities, or performing pre-merge security gate checks. Covers injection, auth, authorization, cryptography, data exposure, misconfiguration, and deserialization.license: CC-BY-4.0---# Security Code ReviewReview code for security vulnerabilities by following the full procedure in `plays/code-review-security.md`.## Steps1. **Scope & Context** — Establish language/framework, trust boundary (server/client/library/CLI), data sensitivity (PII, credentials, financial), and exposure (internet-facing, internal, local).2. **Systematic Review by Vulnerability Class** (priority order): - **Injection (A03)** — SQL, command, XSS, SSTI, LDAP, path traversal, header, log injection - **Authentication & Session (A07)** — Hardcoded credentials, missing auth, weak sessions, JWT issues - **Authorization (A01)** — Missing authz checks, IDOR, horizontal/vertical privilege escalation - **Cryptography (A02)** — Weak algorithms, hardcoded keys, missing encryption, custom crypto - **Data Exposure (A01)** — Sensitive data in errors/logs, credentials in code, debug mode - **Misconfiguration (A05)** — Default credentials, permissive CORS, missing security headers - **Deserialization (A08)** — Untrusted deserialization, missing integrity checks, CSRF gaps3. **Framework-Specific Checks** — Apply checks for detected framework (React, Express, Django, Flask, Spring, Rails, Go).4. **Diff-Specific Analysis** (for PRs) — Focus on changed lines plus context, verify security controls preserved, check new endpoints match auth patterns, look for removed security controls.5. **Produce Findings** — Cite file:line, show vulnerable snippet, explain attack scenario, provide fixed code, rate confidence.## OutputScope summary, findings sorted by severity using `templates/finding.md`, positive observations (good security controls in place), and severity count table.## OWASP References- OWASP Top 10 (2021): A01-A10- OWASP ASVS v5.0- OWASP Code Review Guide- OWASP Cheat Sheet Series

Frequently asked questions