Repo Security Review

Full automated security review pipeline for a code repository. Use this skill whenever the user asks to: review a repo for security issues, run a security audit, find vulnerabilities in a codebase, perform a security assessment, check for OWASP Top 10 and OWASP API Top 10 issues, scan for secrets or exposed credentials, audit dependencies for CVEs, or analyze architecture for security flaws. Trigger even for casual phrasings like "can you check this repo for security issues" or "run security on this". This skill orchestrates a multi-phase pipeline of isolated subagents: secret scanning, tech-s

32 stars 7 forksSecurity

Install

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add Consensys/repo-security-review --skill repo-security-review

Manual install

git clone --depth 1 https://github.com/Consensys/repo-security-review.git /tmp/repo-security-review
mkdir -p ~/.claude/skills
cp -r /tmp/repo-security-review/. ~/.claude/skills/repo-security-review

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

# Security Review Skill

Orchestrates a full, multi-phase security review of a code repository using
Claude Code subagents. Each phase has a narrow responsibility and passes its
output to the next.

## Prerequisites

Before running, ensure these CLI tools are available (install if missing):
- `gitleaks` — secret scanning with git history. Recommended.
- `osv-scanner` — primary CVE scanner; covers all ecosystems from lockfiles. Recommended.
- `semgrep` — static analysis to seed OWASP scanning. Recommended.
- `jq` — EPSS enrichment (Phase 3) and runtime Docker paths (Phase 5). Recommended.
- `pip-audit` — supplementary Python CVE pass (different DB from osv-scanner). Optional (Python repos only).
- `grype` — supplementary Java/Maven CVE pass. Optional (Java repos only).
- `poetry` — exports `poetry.lock` so pip-audit can read it. Optional (Poetry projects only).
- `docker` — runtime PoC validation. Optional (`--runtime` flag only).
- `curl` — live deployment check. Optional (`--verify-deployment` flag only); present on virtually every system by default.
- `playwright` (Python package) + Chromium browser binary — headless-browser escalation, used automatically by `--verify-deployment`/`--runtime` when a check needs it (no separate flag). Optional. Not auto-installed by `setup.sh` — the browser binary download is large; check-only, with an install hint if missing.

`npm audit` is not listed — it is bundled with npm and available automatically in any Node.js project.

Read the full skill on GitHub

Details

Skill name: repo-security-review
Repository: Consensys/repo-security-review
Repo updated: 21 October 2026

FAQ

What does the Repo Security Review skill do?

How do I install the Repo Security Review skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add Consensys/repo-security-review --skill repo-security-review. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is Repo Security Review popular?

It lives in Consensys/repo-security-review, which has 32 GitHub stars and 7 forks.

Related skills

Specforge

GodModeAI2025/specforge-ai-skill

Spec-Driven Requirements Engineering mit Governance-Enforcement. Kombiniert Harness-Patterns, EARS-Syntax, Gherkin und NIS2/KRITIS-NFRs. Erzeugt spec.md, plan.md, tasks.md und mehr. Verwende diesen Skill IMMER bei: Requirements schreiben, User Stories, Spezifikation erstellen, Spec-Driven Development, EARS, Gherkin, Requirements Review, Stakeholder-Analyse, KRITIS, NIS2, STRIDE, ADR, Clarify, Analyze, Checklist, Research, Quickstart, Discover, Reverse Engineering. Auch bei: "erstelle eine Spezifikation", "was fehlt in diesem Requirement", "simuliere einen Security Officer", "STRIDE-Analyse", "

Security

R00 Alirezarezvani Claude Skills Security

Axisfrommall/r02-alirezarezvani-claude-skills-security

🔒 Security & Compliance skill suite derived from alirezarezvani/claude-skills. Security audits, vulnerability management, GDPR/SOC2/ISO27001 compliance and incident response. Provides 10 specialised commands for security, compliance, gdpr workflows.

Security

R00 Borghei Claude Skills Security

InnerPrawn98/r14-borghei-claude-skills-security

🔒 Security & Compliance skill suite derived from borghei/Claude-Skills. Security audits, vulnerability management, GDPR/SOC2/ISO27001 compliance and incident response. Provides 10 specialised commands for security, compliance, gdpr workflows.

Security

Bugbountyrules

sanjarbiy/bugbountyrules

Use for ANY bug bounty, penetration test, or web/API/mobile security assessment: recon, testing endpoints, analyzing Burp traffic or any bug-bounty platform's MCP (HackerOne, Intigriti, Bugcrowd, YesWeHack, Immunefi), reviewing APKs, bypassing a WAF, enforcing scope, hunting a specific vuln class, validating findings, writing reports, or when you are stuck on a target and about to give up. Activates automatically for all bug-bounty and pentest sessions. Runs an autonomous, never-surrender predator methodology: refuses to conclude "secure", exhausts each vuln class to depth, proves a real attac

Security

R00 Glebis Claude Skills Security

lavendertalesun/r20-glebis-claude-skills-security

🔒 Security & Compliance skill suite derived from glebis/claude-skills. Security audits, vulnerability management, GDPR/SOC2/ISO27001 compliance and incident response. Provides 10 specialised commands for security, compliance, gdpr workflows.

Security

R00 Travisvn Awesome Claude Skills Security

regimentpebblehearth/r09-travisvn-awesome-claude-skills-security

🔒 Security & Compliance skill suite derived from travisvn/awesome-claude-skills. Security audits, vulnerability management, GDPR/SOC2/ISO27001 compliance and incident response. Provides 10 specialised commands for security, compliance, gdpr workflows.

Security

Browse the most popular Claude skills, all security skills, or write your own with the skills generator.