Security Reviewer

What it does

When your agent uses it

• Reviewing code for vulnerabilities before a release
• Running SAST, dependency and secrets scans on a repository
• Auditing cloud or infrastructure configuration
• Writing a security report with severity ratings and fixes
• Preparing a compliance checklist for a DevSecOps pipeline

Example prompts

• “Review the payments service for vulnerabilities and write a report with severity ratings.”
• “Scan this repository for hardcoded secrets and list each hit with its file and line.”
• “Run semgrep and npm audit, then triage what they found.”
• “Audit the infrastructure configuration in the deploy folder for security issues.”

Requirements

• Scanning tools such as `semgrep`, `gitleaks` and `trivy`
• Written authorization before active testing
• Pre-approved tools (allowed-tools): Read, Grep, Glob

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

1. 1Scope — Map attack surface and critical paths. Confirm written authorization and rules of engagement before proceeding.
2. 2Scan — Run SAST, dependency, and secrets tools. Example commands
3. 3Review — Manual review of auth, input handling, and crypto. Tools miss context — manual review is mandatory.
4. 4Test and classify — Verify written scope authorization before active testing. Validate findings, rate severity…
5. 5Report — Confirm findings with stakeholder before finalizing. Document with location, impact, and remediation. Report critical findings…

What it can do on your machine

Read from SKILL.md and the folder at commit 1be15d8. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves these tools, so the agent can use them without asking each time:

  • Read
  • Grep
  • Glob

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Shell commands in SKILL.md call:

  • semgrep
  • gitleaks
  • npm
  • trivy

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  Links to these hosts (documentation or services it may open):

  • github.com
  • synergetic.solutions
  • jeffallan.github.io

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Security Reviewer loads about 1.3k tokens when it runs, and up to ~7.5k if it reads all its reference files. Until then it costs about 126 tokens; SKILL.md has 365 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~126

When it runs · the whole SKILL.md, loaded when a task matches

~1.3k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~7.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from Jeffallan/claude-skills at commit 1be15d8, republished under its MIT licence (© Jeffallan). 365 words, ~1,259 tokens.

name

security-reviewer

description

Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists.

allowed-tools

Read, Grep, Glob

license

MIT

metadata.author

https://github.com/Jeffallan

metadata.company

https://synergetic.solutions

metadata.version

1.1.1

metadata.domain

security

metadata.triggers

security review, vulnerability scan, SAST, security audit, penetration test, code audit, security analysis, infrastructure security, DevSecOps, cloud…

metadata.role

specialist

metadata.scope

review

metadata.output-format

report

metadata.related-skills

secure-code-guardian, code-reviewer, devops-engineer, cloud-architect, kubernetes-specialist, api-designer, mcp-developer

ID: FIND-001
Severity: High (CVSS 8.1)
Title: SQL Injection in user search endpoint
File: src/api/users.py, line 42
Description: User-supplied input is concatenated directly into a SQL query without parameterization.
Impact: An attacker can read, modify, or delete database contents.
Remediation: Use parameterized queries or an ORM. Replace `cursor.execute(f"SELECT * FROM users WHERE name='{name}'")`
             with `cursor.execute("SELECT * FROM users WHERE name=%s", (name,))`.
References: CWE-89, OWASP A03:2021

© Jeffallan, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 6 other files (references) in skills/security-reviewer of Jeffallan/claude-skills.

• SKILL.md
• references/infrastructure-security.md
• references/penetration-testing.md
• references/report-template.md
• references/sast-tools.md
• references/secret-scanning.md
• references/vulnerability-patterns.md

Open the folder on GitHubat commit 1be15d8