mohitagw15856/security-review
plugins/pm-security/skills/security-review/SKILL.md
Review a design, PR, or feature for security issues before it ships. Use when asked to do a security review, security-review a change/PR, or check a feature for vulnerabilities. Produces a structured review across the common risk areas (authn/authz, input handling, secrets, data exposure, dependencies), findings ranked by severity with concrete fixes, and a ship / fix-first verdict. For code and systems you own or are authorized to review.
$ install --global
skillsauthnpx skillsauth add mohitagw15856/pm-claude-skills security-reviewInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 2, 2026, 6:54 AM182.0s1 file scanned
SKILL.md
- name:
- security-review
- description:
- Review a design, PR, or feature for security issues before it ships. Use when asked to do a security review, security-review a change/PR, or check a feature for vulnerabilities. Produces a structured review across the common risk areas (authn/authz, input handling, secrets, data exposure, dependencies), findings ranked by severity with concrete fixes, and a ship / fix-first verdict. For code and systems you own or are authorized to review.
Security Review Skill
A security review is a focused pass for the ways a change could be abused — before it reaches production. This skill reviews a design, PR, or feature against the recurring risk areas, ranks findings by severity, and gives a clear verdict with concrete fixes. It's for code/systems you own or are authorized to review, and it complements (not replaces) automated scanners and a formal pentest.
Required Inputs
Ask for these only if they aren't already provided:
- What's under review — the design/diff/feature, and what it does.
- Context — the stack, where it runs, what data/permissions it touches, who can reach it (internet-facing? authenticated?).
- Sensitivity — the assets involved (PII, credentials, money, admin capability) and the threat context.
Output Format
Security review: [change/feature]
Summary & verdict — one-line read and a call: ✅ ship / 🔁 fix-first / ⛔ block, with the gating issue(s).
Review by risk area — scan each and note findings:
- AuthN / AuthZ — is identity verified, and is every action authorized (incl. object-level / IDOR, privilege escalation)?
- Input handling — validation/encoding; injection (SQL/command/template), SSRF, path traversal, deserialization, XSS.
- Secrets & crypto — hard-coded secrets, key handling, weak/absent crypto, tokens in logs/URLs.
- Data exposure — over-broad responses, PII in logs/errors, missing encryption in transit/at rest, verbose errors.
- Dependencies & config — known-vuln libraries, insecure defaults, missing security headers, CORS, permissions.
- Abuse & availability — rate-limiting, resource exhaustion, business-logic abuse, missing audit logging.
Findings (ranked) — each with severity, where, why it's exploitable, and the fix:
| Severity | Area | Finding (how it's exploited) | Fix | |---|---|---|---| | 🔴 Critical/High | | | | | 🟡 Medium | | | | | 🔵 Low / hardening | | | |
What's done well — controls already in place (so they're kept).
Follow-ups — anything needing a scanner, a pentest, or a deeper look.
Quality Checks
- [ ] Every standard risk area is considered (authz incl. IDOR, input/injection, secrets, data exposure, deps, abuse)
- [ ] Findings are ranked by severity with a concrete, actionable fix each
- [ ] Exploitability is explained — why it's a real issue in this context, not a generic warning
- [ ] A clear ship / fix-first / block verdict names the gating issues
- [ ] Existing good controls are acknowledged; deeper follow-ups (scanner/pentest) are flagged
Anti-Patterns
- [ ] Do not produce a generic checklist — tie each finding to this code/design and its exploit path
- [ ] Do not rank everything the same — separate critical from hardening nits
- [ ] Do not report an issue without a fix — give the concrete remediation
- [ ] Do not miss authorization (IDOR/privilege) — it's the most common real-world web flaw
- [ ] Do not review code you don't own or aren't authorized to assess
Based On
Secure code/design review practice (OWASP Top 10 & ASVS risk areas, severity-ranked findings, actionable remediation).
Related Skills
mohitagw15856/win-loss-analysis
business
VerifiedTrustedCommunity
Analyze why deals are won and lost and turn it into an action plan. Use when asked to run a win/loss analysis, review closed-won and closed-lost deals, understand why the team is losing to a competitor, or summarize sales feedback into patterns. Produces a structured win/loss report with themes, win/loss rates by segment and competitor, representative quotes, and prioritized actions for product, marketing, and sales.
1,117SKILL.mdUpdated Jul 2, 2026
mohitagw15856/which-skill
development
VerifiedTrustedCommunity
Route a fuzzy request to the right skill in this library. Use when the user is unsure which skill fits, asks 'which skill should I use for X', describes a task without naming a skill, or when a request could plausibly match several skills. Produces a best-fit recommendation with the inputs to gather, a runner-up with the tie-breaker, and a workflow recipe when the job spans multiple skills.
1,117SKILL.mdUpdated Jul 2, 2026
mohitagw15856/vuln-triage
testing
VerifiedTrustedCommunity
Triage a vulnerability or scanner finding — assess real severity, exploitability, and how urgently to fix. Use when asked to triage a CVE, prioritize scanner/pentest findings, assess a vuln's risk, or decide what to patch first. Produces a triage verdict: CVSS-informed severity adjusted for your context, exploitability, real risk, a fix/mitigation, and an SLA — so you fix what matters, not just what's red.
1,117SKILL.mdUpdated Jul 2, 2026
mohitagw15856/voice-of-customer-program
development
VerifiedTrustedCommunity
Stand up a Voice of Customer (VoC) program that turns feedback into action. Use when asked to build a VoC program, design a customer feedback loop, consolidate feedback sources, or set up a closed-loop feedback process. Produces a VoC program design — objectives, feedback sources and channels, a taxonomy, collection and analysis cadence, closed-loop routing, ownership, and success metrics.
1,117SKILL.mdUpdated Jul 2, 2026