Security Reviewer
Audits code and infrastructure for vulnerabilities and writes severity-rated security reports with fixes.
- Repository
- Jeffallan/claude-skills
- Stars
- 12,176
- Licence
- MIT
- Files
- 7 files
What it does
Once installed, the agent works like a security analyst reviewing a codebase or system. It follows a structured process: map the attack surface, run common security scanners (such as Semgrep, Bandit, gitleaks, npm audit, and Trivy), manually review authentication, input handling and cryptography, then rate each finding by severity using CVSS. It produces a structured report with locations, impact, and remediation advice for each issue. The skill also includes reference notes on vulnerability patterns, secret scanning, penetration testing, infrastructure security, and a report template that the agent loads when relevant.
Great for
- Developers who want a second set of eyes on their code before release
- Security-minded teams preparing an audit report or compliance checklist
- Engineers triaging scanner output and needing clear remediation steps
Skip it if
- Testing live or production systems without written authorization, since the skill's own rules require scope approval before active testing and the agent could still be pointed at systems you do not own
- Replacing a professional penetration test or certified audit, because it relies on automated tools and an AI's manual review, which can miss issues
Try asking
- “Review the authentication and input handling in this Node.js API and give me a severity-rated report”
- “Scan this repository for hardcoded secrets and tell me how to remediate each one”
- “Run a dependency audit on this project and prioritize the vulnerabilities by risk”
- “Draft an executive summary and findings table for a security review of our Terraform infrastructure”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 7 original files, the MIT licence and an attribution note.
security-reviewer.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip security-reviewer.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip security-reviewer.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Provide written scope and rules of engagement up front so the agent confirms authorization before any active testing
- Ask the agent to run the listed scanners first, then add manual review of the flagged areas for better results
- Specify the output format you need, such as an executive summary or a findings table, to get a report tailored to your audience
What's inside
- references/infrastructure-security.md
- references/penetration-testing.md
- references/report-template.md
- references/sast-tools.md
- references/secret-scanning.md
- references/vulnerability-patterns.md
- SKILL.md
Redistributed unmodified from Jeffallan/claude-skills under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.