What vulnerability patterns does it cover?

It identifies a wide range of issues including OWASP Top 10 threats, SQL injection, Cross-Site Scripting (XSS), insecure cryptography, and authentication bypasses.

Which files does the security agent prioritize?

The agent focuses on high-impact areas including files containing 'auth', 'login', or 'api', as well as middleware, database configurations, and environment loaders.

How does it handle false positives for test values?

The skill is configured to ignore common placeholders like 'TODO' or 'changeme' and can recognize vulnerabilities that are already mitigated by documented upstream protections.

Does this skill detect hardcoded secrets?

Yes, it specifically scans for API keys, passwords, and other sensitive credentials in configuration, environment files, and source code.

Security Code Reviewer

Name: Security Code Reviewer
Author: JesseNaranjo

byJesseNaranjo

•

セキュリティとテスト

Identifies security vulnerabilities, injection attacks, and hardcoded secrets through deep analysis of authentication and configuration files.

The Security Code Reviewer skill transforms Claude into a specialized security auditor, scanning source code for OWASP Top 10 vulnerabilities, authentication bypasses, and insecure cryptographic practices. It intelligently prioritizes high-risk files—such as middleware, environment configurations, and authentication logic—while utilizing specialized references to minimize false positives for documented upstream protections. By focusing on critical attack vectors and sensitive data handling, this skill helps developers identify and remediate security risks early in the development lifecycle.

主な機能

01Detection of injection attacks and insecure cryptography

02Advanced false positive filtering for documented placeholders

031 GitHub stars

04Automated secret and hardcoded credential scanning

05Smart prioritization of authentication and middleware files

06Comprehensive OWASP Top 10 vulnerability detection

ユースケース

01Conducting pre-production security audits for web applications

02Hardening authentication logic and middleware against bypass risks

03Scanning pull requests for accidentally committed API keys or secrets

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add jessenaranjo/ai-setup reviewing-security

For use in Claude.ai and ChatGPT

Download Skill