security-review

Solid

Security review orchestrator for dependency lockfiles and source: inventory of lockfiles/manifests (npm, pip, cargo, go, gem, maven, gradle, composer), exit-code classifier for 13 security tools (semgrep, bandit, gitleaks, osv-scanner, pip-audit, trufflehog, checkov, trivy, grype, npm audit, cargo audit), JSON normalizer to a unified finding schema, and human-readable reports. Stdlib-only Python helper + workflow for OWASP-aligned security review.

AI & Automation 5 stars 0 forks Updated yesterday MIT

Install

View on GitHub

Quality Score: 80/100

Stars 20%
26
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
80
License 10%
100
Description 5%
100

Skill Content

# Security Review — dependency & static analysis orchestration Load this skill when you need to run a **security review of a codebase**: audit the dependency manifest/lockfile inventory, decide which scanner to run per ecosystem, interpret scanner exit codes correctly (real findings vs. infrastructure errors), and normalize reports from different tools into **one unified schema** for a final report. The helper script is **offline by design** — it inventories, classifies, and normalizes. Actual scans are executed by the well-known external tools listed below (install once locally or in CI). --- ## The helper script `scripts/security_review.py` — pure Python 3 stdlib (no dependencies). | Command | Purpose | |---|---| | `security_review.py inventory --dir . ` | List dependency locks with ecosystem + suggested tool | | `security_review.py inventory --dir . --json` | Same, machine-readable | | `security_review.py classify --tool semgrep --exit-code 1` | Explain what a tool exit code means | | `security_review.py normalize --tool osv-scanner --input out.json` | Flatten a tool JSON report into unified findings | | `security_review.py normalize --tool pip-audit --input pip.json --output report.json` | Save unified report | | `security_review.py report --root .` | Report skeleton (markdown default, `--json` for JSON) | ### Lockfile inventory (per-ecosystem suggested tool) | Lockfile / manifest | Ecosystem | Suggested tool | |---|---|---| | `package-lock.json`, `pnpm-lock.yaml`...

Details

Author
bestdeejay-design
Repository
bestdeejay-design/agent-skills
Created
1 weeks ago
Last Updated
yesterday
Language
Python
License
MIT

Similar Skills

Semantically similar based on skill content — not just same category

DevOps & Infrastructure Solid

appsec

Application-level security review: dependency manifests for known-vulnerable packages, missing HTTP security headers, permissive CORS configuration. Use when user says 'review my dependencies', 'check for vulnerable packages', 'run a dependency audit', 'audit security headers', 'review CORS config', or when working in package.json/package-lock.json, go.mod/go.sum, requirements.txt/poetry.lock, Gemfile.lock, Cargo.toml/Cargo.lock, pom.xml, or server/app config with CORS or header middleware.

8 Updated 2 weeks ago
anmolnagpal
Code & Development Listed

hive-security-reviewer

Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists.

0 Updated 2 weeks ago
ImRaffy14
API & Backend Listed

security-review

A focused, single-lens security review of a change. The one specialist a user runs alone when they care about exploitability — not a general sweep. Core method is taint tracing - follow untrusted input from its source, across the trust boundary, to a dangerous sink - and prove the path is reachable before calling it a finding. Covers injection (SQL/NoSQL/command/LDAP), XSS, SSRF, path traversal, insecure deserialization, authn/authz gaps (missing permission checks, IDOR), secret handling, sensitive-data exposure in logs/errors/URLs, crypto misuse, and unsafe defaults. Every finding cites file:line, a severity (a real exploit path is a blocker), the concrete attack, and a fix.

0 Updated yesterday
itzikiusa