AppSec Code Review: Vulnerability Assessment
Uncover Hidden Vulnerabilities Through Threat-Driven Code Review
What You Can Do
You can systematically analyze application code to identify security vulnerabilities using threat-driven patterns based on OWASP standards and industry best practices. The skill evaluates code across multiple attack vectors—authentication, data protection, injection attacks, cryptography, and business logic flaws—producing a prioritized report with severity scores and remediation guidance for each finding.
Features
Applies OWASP Top 10 and CWE patterns to identify real-world attack vectors in your code
Scans for auth bypass, crypto weaknesses, injection flaws, sensitive data exposure, and logic errors in a single pass
Assigns CVSS-style scores and business impact ratings so you prioritize high-risk findings first
Provides code examples and step-by-step fixes for each vulnerability, not just flagging problems
Uses contextual security analysis to eliminate noise, focusing only on genuine exploitable flaws
Links each finding to OWASP, CWE, and PCI-DSS standards for audit trails and policy alignment
Produces a formatted report with executive summary, detailed findings, and remediation roadmap
Adapts review to your architecture, tech stack, and business-specific risk profiles
Example Output
Example 1: SQL Injection Vulnerability
Finding: Unparameterized SQL query in authentication endpoint
// ❌ Vulnerable
const query = `SELECT * FROM users WHERE email = '${email}'`;
// ✅ Fixed
const query = 'SELECT * FROM users WHERE email = $1';
db.query(query, [email]);
Severity: Critical (CVSS 9.8) | CWE-89 | OWASP A1
Example 2: Weak Cryptography
Finding: MD5 hash used for password storage
Impact: Attacker can crack passwords using precomputed rainbow tables
Fix: Replace with bcrypt or Argon2 with appropriate salt cost
Severity: High (CVSS 7.5)
Example 3: Sensitive Data Exposure
Finding: API response includes unmasked credit card numbers and SSN
Risk: PCI-DSS violation, regulatory fines, customer breach notification
Remediation: Mask PII in API responses; encrypt in transit with TLS 1.3+
Severity: High (CVSS 8.2)
What's Included
- SKILL.md: Full threat-driven code review framework with decision trees and heuristics
- OWASP Top 10 Checklist: Structured vulnerability patterns for each category
- Threat Model Template: Worksheet to define your application's attack surface
- Vulnerability Scoring Matrix: CVSS calculation and risk prioritization guide
- Remediation Code Snippets Library: Common fixes for injection, auth, crypto, and data exposure
- Security Report Template: Executive summary, findings table, remediation roadmap
- CWE/OWASP/PCI-DSS Cross-Reference: Map findings to compliance frameworks
Who It's For
- Security engineers conducting code reviews and penetration testing
- DevOps and platform engineers integrating security into CI/CD pipelines
- Software architects designing secure systems and threat modeling
- Compliance officers managing OWASP, PCI-DSS, and SOC 2 requirements
- Developers performing peer review and security-focused code audits
Best For
- Pre-deployment security code audits before production releases
- Vulnerability assessment ahead of compliance reviews and audits
- Security training and threat-awareness education for development teams
- Third-party and vendor code evaluation during procurement
- Legacy code refactoring to meet modern security standards
You might also like
Rapidly analyze production incidents by correlating observability signals—logs, metrics, traces, and events—to identify the true root cause instead of symptoms. You'll reconstruct incident timelines, quantify impact scope, and generate both immediate remediation steps and long-term prevention measures.
Claude analyzes your code diffs and generates standardized commit messages that follow the Conventional Commits specification. The skill automatically determines the correct commit type, scope, and description based on the changes you've made, ensuring your messages are parseable by automation tools while remaining human-readable for code reviewers.
You can perform deep audits of your project dependencies across multiple package ecosystems, identifying security vulnerabilities with CVSS scores, outdated versions, license incompatibilities, and unused packages. The skill generates a prioritized upgrade roadmap that balances security urgency, stability risk, and effort cost—helping you reduce supply chain risk and technical debt without destabilizing production.
You'll transform high-level feature requirements into a complete development plan covering API design, frontend implementation, testing strategy, and documentation. The skill helps you identify dependencies, parallelize work across frontend and backend teams, and establish quality gates that ensure features ship bug-free with proper error handling and logging.
Transform schema and data changes into production-ready migration packages that protect data integrity and minimize downtime. You can handle column additions, renames, type conversions, and backfills using proven patterns like expand-contract and shadow tables. The skill generates explicit rollback scripts, validation checklists, and phased execution plans that keep applications stable throughout the migration.
You can create comprehensive performance testing strategies tailored to your application's architecture, analyze test results to identify bottlenecks, and generate prioritized recommendations for optimization. The skill helps you design load tests, interpret metrics like latency and throughput, and create action plans for performance improvements.
You can design comprehensive performance test strategies tailored to your application architecture, analyze performance metrics and logs to identify bottlenecks, and receive specific optimization recommendations. The skill guides you through creating realistic load scenarios, interpreting performance data, and prioritizing fixes based on impact analysis.
You can accelerate your entire antenna design workflow—from initial concept to optimized specifications—by leveraging Claude's knowledge of electromagnetic theory, antenna types, and design trade-offs. Claude helps you parameterize designs, identify optimal configurations for your frequency band and application, and prepare detailed briefs for simulation and manufacturing. You'll generate design reviews, impedance-matching solutions, and validation checklists without context-switching to multiple tools.