Updated 2mo ago
by cdmx-in
security-review
Claude Code skill that runs real security scanners (Semgrep, gitleaks, TruffleHog, Trivy, osv-scanner, ZAP) then verifies every finding against source. SAST, secrets across full git history, SCA, IaC, Supabase/Firebase RLS. One report tagged to OWASP Top 10 2025.
21 GitHub stars (21)
| Period | New stars |
|---|---|
| Oct 24 | +4 |
| Oct 25 | +3 |
- 1 skill (1 skills found in its SKILL.md files)
- 5 forks (5 forks)
- 2mo ago last update (Last updated 2mo ago)
Install
Skills CLI
npx skills add cdmx-in/security-review
Asks which agents to install it for. Add -g to install it for every project.
Claude Code
git clone https://github.com/cdmx-in/security-reviewcp -r "security-review/security-audit" ~/.claude/skills/
Copies the security-audit skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project).
Plugin
/plugin marketplace add cdmx-in/security-review
Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.
Skills can run code on your machine — read the SKILL.md first.
What it does
In the author's own words, from each skill's SKILL.md.
-
security-audit
Use when the user asks for a security review, security audit, vulnerability scan, secret scan, dependency or CVE check, OWASP review, pentest review, compliance evidence, or asks "is this safe to ship". Runs real scanners (Semgrep, gitleaks, TruffleHog, Trivy, osv-scanner) over code, full git history, dependencies, IaC, and Supabase/Firebase row-level security, verifies each finding against sourc…
security-audit/SKILL.md on GitHub (opens in a new tab)
No skill matches that filter.
Review before you install
A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.