Security Reviewer
Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists.
Install
npx skills add Jeffallan/claude-skills --skill security-reviewergit clone --depth 1 https://github.com/Jeffallan/claude-skills.git /tmp/claude-skills
mkdir -p ~/.claude/skills
cp -r /tmp/claude-skills/skills/security-reviewer ~/.claude/skills/security-reviewerPersonal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.
From the SKILL.md
# Security Reviewer Security analyst specializing in code review, vulnerability identification, penetration testing, and infrastructure security. ## When to Use This Skill - Code review and SAST scanning - Vulnerability scanning and dependency audits - Secrets scanning and credential detection - Penetration testing and reconnaissance - Infrastructure and cloud security audits - DevSecOps pipelines and compliance automation ## Core Workflow 1. **Scope** — Map attack surface and critical paths. Confirm written authorization and rules of engagement before proceeding. 2. **Scan** — Run SAST, dependency, and secrets tools. Example commands: - `semgrep --config=auto .` - `bandit -r ./src` - `gitleaks detect --source=.` - `npm audit --audit-level=moderate` - `trivy fs .` 3. **Review** — Manual review of auth, input handling, and crypto. Tools miss context — manual review is mandatory. 4. **Test and classify** — **Verify written scope authorization before active testing.** Validate findings, rate severity (Critical/High/Medium/Low/Info) using CVSS. Confirm exploitability with proof-of-concept only; do not exceed it. 5. **Report** — Confirm findings with stakeholder before finalizing. Document with location, impact, and remediation. Report critical findings immediately. ## Reference Guide Load detailed guidance based on context: | Topic | Reference | Load When | |-------|-----------|-----------|
Details
- Skill name
security-reviewer- Repository
- Jeffallan/claude-skills
- Path
skills/security-reviewer/SKILL.md- License
- MIT
- Repo updated
- 30 October 2026
FAQ
What does the Security Reviewer skill do?
Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists.
How do I install the Security Reviewer skill?
skills CLI (Claude Code, Cursor, Codex and more): npx skills add Jeffallan/claude-skills --skill security-reviewer. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.
Is Security Reviewer popular?
It lives in Jeffallan/claude-skills, which has 12,146 GitHub stars and 1,162 forks, and is included in 3 curated skill lists.
Related skills
API Designer
12kJeffallan/claude-skills
Use when designing REST or GraphQL APIs, creating OpenAPI specifications, or planning API architecture. Invoke for resource modeling, versioning strategies, pagination patterns, error handling standards.
Code Documenter
12kJeffallan/claude-skills
Generates, formats, and validates technical documentation — including docstrings, OpenAPI/Swagger specs, JSDoc annotations, doc portals, and user guides. Use when adding docstrings to functions or classes, creating API documentation, building documentation sites, or writing tutorials and user guides. Invoke for OpenAPI/Swagger specs, JSDoc, doc portals, getting started guides.
Debugging Wizard
12kJeffallan/claude-skills
Parses error messages, traces execution flow through stack traces, correlates log entries to identify failure points, and applies systematic hypothesis-driven methodology to isolate and resolve bugs. Use when investigating errors, analyzing stack traces, finding root causes of unexpected behavior, troubleshooting crashes, or performing log analysis, error investigation, or root cause analysis.
Deepsec
8.3kvercel-labs/deepsec
Run deepsec, an AI-powered cyber-security vulnerability scanner. Activates when the user invokes /deepsec, asks to run deepsec, or wants to scan their repo, branch, or uncommitted changes for vulnerabilities.
Secure Code Guardian
12kJeffallan/claude-skills
Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities — including custom security implementations such as hashing passwords with bcrypt/argon2, sanitizing SQL queries with parameterized statements, configuring CORS/CSP headers, validating input with Zod, and setting up JWT tokens. Invoke for authentication, authorization, input validation, encryption, OWASP Top 10 prevention, secure session management, and security hardening. For pre-built OAuth/SSO integrations or standalone security audits, consider a more specialized skill.
Bug Bounty
5.5kawarexone/Agentic-Bug-Hunter
Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via co
Browse the most popular Claude skills, all security skills, or write your own with the skills generator.