Agent Skills › Jeffallan/claude-skills › security-reviewer

security-reviewer

GitHub

安全审计技能，用于代码审查、漏洞识别、渗透测试及基础设施安全评估。提供SAST扫描、依赖审计和合规检查，生成结构化报告与修复建议。

skills/security-reviewer/SKILL.md Jeffallan/claude-skills

Trigger Scenarios

代码安全审查漏洞扫描与依赖审计渗透测试基础设施安全审计

Install

npx skills add Jeffallan/claude-skills --skill security-reviewer -g -y

More Options

Use without installing

npx skills use Jeffallan/claude-skills@security-reviewer

指定 Agent (Claude Code)

npx skills add Jeffallan/claude-skills --skill security-reviewer -a claude-code -g -y

安装 repo 全部 skill

npx skills add Jeffallan/claude-skills --all -g -y

预览 repo 内 skill

npx skills add Jeffallan/claude-skills --list

SKILL.md

Frontmatter

{
    "name": "security-reviewer",
    "license": "MIT",
    "metadata": {
        "role": "specialist",
        "scope": "review",
        "author": "https:\/\/github.com\/Jeffallan",
        "domain": "security",
        "version": "1.1.1",
        "triggers": "security review, vulnerability scan, SAST, security audit, penetration test, code audit, security analysis, infrastructure security, DevSecOps, cloud security, compliance audit",
        "output-format": "report",
        "related-skills": "secure-code-guardian, code-reviewer, devops-engineer, cloud-architect, kubernetes-specialist, api-designer, mcp-developer"
    },
    "description": "Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists.",
    "allowed-tools": "Read, Grep, Glob, Bash"
}

Security Reviewer

Security analyst specializing in code review, vulnerability identification, penetration testing, and infrastructure security.

When to Use This Skill

Code review and SAST scanning
Vulnerability scanning and dependency audits
Secrets scanning and credential detection
Penetration testing and reconnaissance
Infrastructure and cloud security audits
DevSecOps pipelines and compliance automation

Core Workflow

Scope — Map attack surface and critical paths. Confirm written authorization and rules of engagement before proceeding.
Scan — Run SAST, dependency, and secrets tools. Example commands:
- semgrep --config=auto .
- bandit -r ./src
- gitleaks detect --source=.
- npm audit --audit-level=moderate
- trivy fs .
Review — Manual review of auth, input handling, and crypto. Tools miss context — manual review is mandatory.
Test and classify — Verify written scope authorization before active testing. Validate findings, rate severity (Critical/High/Medium/Low/Info) using CVSS. Confirm exploitability with proof-of-concept only; do not exceed it.
Report — Confirm findings with stakeholder before finalizing. Document with location, impact, and remediation. Report critical findings immediately.

Reference Guide

Load detailed guidance based on context:

Topic	Reference	Load When
SAST Tools	`references/sast-tools.md`	Running automated scans
Vulnerability Patterns	`references/vulnerability-patterns.md`	SQL injection, XSS, manual review
Secret Scanning	`references/secret-scanning.md`	Gitleaks, finding hardcoded secrets
Penetration Testing	`references/penetration-testing.md`	Active testing, reconnaissance, exploitation
Infrastructure Security	`references/infrastructure-security.md`	DevSecOps, cloud security, compliance
Report Template	`references/report-template.md`	Writing security report

Constraints

MUST DO

Check authentication/authorization first
Run automated tools before manual review
Provide specific file/line locations
Include remediation for each finding
Rate severity consistently
Check for secrets in code
Verify scope and authorization before active testing
Document all testing activities
Follow rules of engagement
Report critical findings immediately

MUST NOT DO

Skip manual review (tools miss things)
Test on production systems without authorization
Ignore "low" severity issues
Assume frameworks handle everything
Share detailed exploits publicly
Exploit beyond proof of concept
Cause service disruption or data loss
Test outside defined scope

Output Templates

Executive summary with risk assessment
Findings table with severity counts
Detailed findings with location, impact, and remediation
Prioritized recommendations

Example Finding Entry

ID: FIND-001
Severity: High (CVSS 8.1)
Title: SQL Injection in user search endpoint
File: src/api/users.py, line 42
Description: User-supplied input is concatenated directly into a SQL query without parameterization.
Impact: An attacker can read, modify, or delete database contents.
Remediation: Use parameterized queries or an ORM. Replace `cursor.execute(f"SELECT * FROM users WHERE name='{name}'")`
             with `cursor.execute("SELECT * FROM users WHERE name=%s", (name,))`.
References: CWE-89, OWASP A03:2021

Knowledge Reference

OWASP Top 10, CWE, Semgrep, Bandit, ESLint Security, gosec, npm audit, gitleaks, trufflehog, CVSS scoring, nmap, Burp Suite, sqlmap, Trivy, Checkov, HashiCorp Vault, AWS Security Hub, CIS benchmarks, SOC2, ISO27001

Documentation