Secure Code Reviewer
Identify security vulnerabilities in code changes before production deployment
What You Can Do
This skill reviews code changes with security-focused analysis, flagging injection attacks (SQL, command, template), hardcoded secrets, improper error handling, weak cryptography, and access control issues. It provides context-aware risk assessment, severity ratings, and actionable remediation strategies—complementing automated tools with human-level reasoning about business impact and secure coding patterns.
Features
Identifies SQL injection, command injection, template injection, and expression language injection vulnerabilities
Flags hardcoded credentials, unencrypted sensitive data, excessive logging, and PII handling violations
Detects weak algorithms, improper key management, timing attack risks, and unsafe random number generation
Reviews privilege escalation risks, broken access control, session management flaws, and token handling
Catches stack trace leakage, information disclosure through error messages, and improper exception handling
Identifies unsafe deserialization, dynamic code execution, and eval() usage risks
Ranks findings by severity, exploitability, and business impact with clear remediation guidance
Maps issues to OWASP Top 10, CWE, and relevant security standards
Example Output
Example 1: SQL Injection Detection
- ⚠️ HIGH SEVERITY - SQL Injection Risk
Line 42: SELECT * FROM users WHERE id = ' + userId + '
Risk: User input directly concatenated into SQL query
Remediation: Use parameterized queries or prepared statements
Example: connection.query('SELECT * FROM users WHERE id = ?', [userId])
Example 2: Hardcoded Secret Detection
- 🔴 CRITICAL - Exposed Credentials
Line 15: const apiKey = 'sk-1234567890abcdef'
Risk: API key stored in source code, visible in git history
Remediation: Move to environment variables or secrets manager
Example: const apiKey = process.env.API_KEY
Example 3: Weak Cryptography
- ⚠️ MEDIUM SEVERITY - Cryptographic Weakness
Line 87: const hash = md5(password)
Risk: MD5 is cryptographically broken for password hashing
Remediation: Use bcrypt, Argon2, or scrypt for password storage
What's Included
- secure-code-reviewer.md: Core instruction file with threat modeling framework and vulnerability taxonomy
- Security Checklist: OWASP Top 10 mapping and common vulnerability patterns by language
- Risk Assessment Template: Severity scoring matrix and business impact evaluation guide
- Remediation Reference: Secure coding examples for common vulnerabilities (SQL, injection, auth, crypto)
- Code Review Workflow: Step-by-step process for reviewing diffs, PRs, and components
Who It's For
- Security Engineers — Conducting code reviews and vulnerability assessments
- Software Developers — Learning secure coding practices and self-reviewing work
- DevSecOps Engineers — Integrating security checkpoints into CI/CD pipelines
- Technical Leads — Establishing code security standards for teams
- Compliance Officers — Ensuring adherence to security standards (OWASP, CWE, GDPR)
Best For
- Pull request and merge request security reviews before deployment
- Analyzing code changes in authentication, authorization, and data handling
- Evaluating third-party library integrations for security risks
- Security-focused code audits of critical or sensitive components
- Developer training and secure coding pattern education
- Post-incident analysis of reported security vulnerabilities
You might also like
You can accelerate your entire antenna design workflow—from initial concept to optimized specifications—by leveraging Claude's knowledge of electromagnetic theory, antenna types, and design trade-offs. Claude helps you parameterize designs, identify optimal configurations for your frequency band and application, and prepare detailed briefs for simulation and manufacturing. You'll generate design reviews, impedance-matching solutions, and validation checklists without context-switching to multiple tools.
You can convert raw API code, OpenAPI specs, GraphQL schemas, and implementation details into production-ready reference documentation. The skill generates systematically organized endpoint documentation with parameter tables, real request/response examples, error code catalogs, authentication details, rate limits, and SDK usage snippets in multiple programming languages—creating the authoritative developer reference for REST APIs, GraphQL APIs, WebSocket APIs, and webhook schemas.
Rapidly analyze production incidents by correlating observability signals—logs, metrics, traces, and events—to identify the true root cause instead of symptoms. You'll reconstruct incident timelines, quantify impact scope, and generate both immediate remediation steps and long-term prevention measures.
This skill guides you through designing Kalman filters for your specific state estimation and sensor fusion problems. You'll learn to diagnose filter divergence, tune covariance matrices (Q and R), and validate observability—turning mathematical theory into production-ready filters. The skill provides step-by-step workflows, diagnostic tools, and practical templates for common applications like GPS/IMU fusion, SLAM, and aircraft navigation.
Claude analyzes your code diffs and generates standardized commit messages that follow the Conventional Commits specification. The skill automatically determines the correct commit type, scope, and description based on the changes you've made, ensuring your messages are parseable by automation tools while remaining human-readable for code reviewers.
You can perform deep audits of your project dependencies across multiple package ecosystems, identifying security vulnerabilities with CVSS scores, outdated versions, license incompatibilities, and unused packages. The skill generates a prioritized upgrade roadmap that balances security urgency, stability risk, and effort cost—helping you reduce supply chain risk and technical debt without destabilizing production.
You'll transform high-level feature requirements into a complete development plan covering API design, frontend implementation, testing strategy, and documentation. The skill helps you identify dependencies, parallelize work across frontend and backend teams, and establish quality gates that ensure features ship bug-free with proper error handling and logging.
You can rapidly design, optimize, and validate chromatographic and LC-MS/MS methods for analyzing drugs and metabolites in biological matrices. This skill guides you through analytical method development workflows—including parameter selection, sensitivity optimization, and regulatory strategy—while ensuring ICH Q2(R2) and FDA compliance throughout the development process.