security-reviewer

An agent skill by Jeffallan, from Jeffallan/claude-skills. Tags: compliance, debugging, documentation, evaluation, security.

What it does

Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add Jeffallan/claude-skills --skill security-reviewer

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/Jeffallan/claude-skills
cp -r claude-skills/skills/security-reviewer ~/.claude/skills/security-reviewer

Safety box score

Not rated yet. A safety box score grades what a skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. Anyone can request one from this page; it is saved for everyone. How the score works.

Source

Repository

Jeffallan/claude-skills (all skills from this repository)

Path

skills/security-reviewer/SKILL.md

Branch

main

Updated

2026-09-19

Related skills

• fp-check — Systematically verifies suspected security bugs to eliminate false positives.
• code-reviewer — Analyzes code diffs and files to identify bugs, security vulnerabilities (SQL injection, XSS, insecure deserialization), code smells, N+1 queries.
• secure-code-guardian — Use when implementing authentication/authorization, securing user input.
• srdf — MoveIt2 SRDF authoring, validation, and planning-semantics workflow.
• urdf — URDF robot description authoring and validation.
• address-sanitizer — Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests.