Skills Explorer Add Skills

security-reviewer

An agent skill by Jeffallan, from Jeffallan/claude-skills. Tags: compliance, debugging, documentation, evaluation, security.

What it does

Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add Jeffallan/claude-skills --skill security-reviewer

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/Jeffallan/claude-skills
cp -r claude-skills/skills/security-reviewer ~/.claude/skills/security-reviewer

Safety box score

Grade D, elevated risk: 49 of 100 risk points, rated 2026-09-24. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a security-audit workflow that runs SAST, dependency, and secret-scanning tools, and it also includes active penetration-testing and cloud-security commands. Its main blast radius is network probing, broad reads of host and log data, and some privileged/account-wide changes if the examples are run against real systems; the shipped files are plain markdown with no hidden binaries.

Category levels, from 0 (none) to 3 (high)
CategoryLevelWhy
Code & shell execution2 (moderate)It drives many shell/package commands such as `semgrep --config=auto .`, `npx snyk test`, `pip install bandit`, `go install ...@latest`, and `brew install trivy`, so it can execute fetched tooling even though it does not eval arbitrary code.
Network access2 (moderate)The references explicitly query and probe remote systems, e.g. `curl -s "https://crt.sh/?q=%.example.com&output=json"`, `nmap -sV -p- target.com`, and `curl https://api.target.com/login -d "user=test&pass=test"`.
Filesystem reach2 (moderate)It reads outside the project with commands like `cat ~/.bash_history`, `/var/log/auth.log`, `/var/log/nginx/*.log`, and mounts `/var/run/docker.sock`, which can expose host data beyond the repo.
Secrets & credentials2 (moderate)Secret-hunting is a core use case (`gitleaks detect --source . --log-opts="--all"`, `grep -rn "api_key\|secret\|password"`), and the docs also show secret-shaped values such as `GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}` and `api_key="secret123"`.
Privilege & persistence2 (moderate)It includes system-wide installs and privileged host access patterns such as `go install ...@latest`, `brew install gitleaks`, and `docker run ... --cap-add audit_control -v /var/run/docker.sock:/var/run/docker.sock`.
Instruction hijack surface0 (none)There is no prompt-injection, hidden instruction, or instruction to ignore safeguards; the content is readable markdown guidance only.
Irreversible actions2 (moderate)The skill can perform active testing and account-level changes, including `aws guardduty create-detector --enable`, `aws cloudtrail create-trail ...`, and `aws iam update-account-password-policy ...`, though it also says to verify scope and authorization first.
Transparency0 (none)All shipped files are plain text markdown; there are no binaries, encoded blobs, or unreadable runtime payloads.

Before installing

Rated 2026-09-24 by an automated review of 7 files from the skill's repository.

Source

Repository
Jeffallan/claude-skills (all skills from this repository)
Path
skills/security-reviewer/SKILL.md
Branch
main
Updated
2026-09-19