AppSec Code Review: Vulnerability Assessment
Uncover Hidden Vulnerabilities Through Threat-Driven Code Review
What You Can Do
You can systematically analyze application code to identify security vulnerabilities using threat-driven patterns based on OWASP standards and industry best practices. The skill evaluates code across multiple attack vectors—authentication, data protection, injection attacks, cryptography, and business logic flaws—producing a prioritized report with severity scores and remediation guidance for each finding.
Features
Applies OWASP Top 10 and CWE patterns to identify real-world attack vectors in your code
Scans for auth bypass, crypto weaknesses, injection flaws, sensitive data exposure, and logic errors in a single pass
Assigns CVSS-style scores and business impact ratings so you prioritize high-risk findings first
Provides code examples and step-by-step fixes for each vulnerability, not just flagging problems
Uses contextual security analysis to eliminate noise, focusing only on genuine exploitable flaws
Links each finding to OWASP, CWE, and PCI-DSS standards for audit trails and policy alignment
Produces a formatted report with executive summary, detailed findings, and remediation roadmap
Adapts review to your architecture, tech stack, and business-specific risk profiles
Example Output
Example 1: SQL Injection Vulnerability
Finding: Unparameterized SQL query in authentication endpoint
// ❌ Vulnerable
const query = `SELECT * FROM users WHERE email = '${email}'`;
// ✅ Fixed
const query = 'SELECT * FROM users WHERE email = $1';
db.query(query, [email]);
Severity: Critical (CVSS 9.8) | CWE-89 | OWASP A1
Example 2: Weak Cryptography
Finding: MD5 hash used for password storage
Impact: Attacker can crack passwords using precomputed rainbow tables
Fix: Replace with bcrypt or Argon2 with appropriate salt cost
Severity: High (CVSS 7.5)
Example 3: Sensitive Data Exposure
Finding: API response includes unmasked credit card numbers and SSN
Risk: PCI-DSS violation, regulatory fines, customer breach notification
Remediation: Mask PII in API responses; encrypt in transit with TLS 1.3+
Severity: High (CVSS 8.2)
What's Included
- SKILL.md: Full threat-driven code review framework with decision trees and heuristics
- OWASP Top 10 Checklist: Structured vulnerability patterns for each category
- Threat Model Template: Worksheet to define your application's attack surface
- Vulnerability Scoring Matrix: CVSS calculation and risk prioritization guide
- Remediation Code Snippets Library: Common fixes for injection, auth, crypto, and data exposure
- Security Report Template: Executive summary, findings table, remediation roadmap
- CWE/OWASP/PCI-DSS Cross-Reference: Map findings to compliance frameworks
Who It's For
- Security engineers conducting code reviews and penetration testing
- DevOps and platform engineers integrating security into CI/CD pipelines
- Software architects designing secure systems and threat modeling
- Compliance officers managing OWASP, PCI-DSS, and SOC 2 requirements
- Developers performing peer review and security-focused code audits
Best For
- Pre-deployment security code audits before production releases
- Vulnerability assessment ahead of compliance reviews and audits
- Security training and threat-awareness education for development teams
- Third-party and vendor code evaluation during procurement
- Legacy code refactoring to meet modern security standards
You might also like
You can accelerate your entire antenna design workflow—from initial concept to optimized specifications—by leveraging Claude's knowledge of electromagnetic theory, antenna types, and design trade-offs. Claude helps you parameterize designs, identify optimal configurations for your frequency band and application, and prepare detailed briefs for simulation and manufacturing. You'll generate design reviews, impedance-matching solutions, and validation checklists without context-switching to multiple tools.
You can convert raw API code, OpenAPI specs, GraphQL schemas, and implementation details into production-ready reference documentation. The skill generates systematically organized endpoint documentation with parameter tables, real request/response examples, error code catalogs, authentication details, rate limits, and SDK usage snippets in multiple programming languages—creating the authoritative developer reference for REST APIs, GraphQL APIs, WebSocket APIs, and webhook schemas.
Rapidly analyze production incidents by correlating observability signals—logs, metrics, traces, and events—to identify the true root cause instead of symptoms. You'll reconstruct incident timelines, quantify impact scope, and generate both immediate remediation steps and long-term prevention measures.
This skill guides you through designing Kalman filters for your specific state estimation and sensor fusion problems. You'll learn to diagnose filter divergence, tune covariance matrices (Q and R), and validate observability—turning mathematical theory into production-ready filters. The skill provides step-by-step workflows, diagnostic tools, and practical templates for common applications like GPS/IMU fusion, SLAM, and aircraft navigation.
Claude analyzes your code diffs and generates standardized commit messages that follow the Conventional Commits specification. The skill automatically determines the correct commit type, scope, and description based on the changes you've made, ensuring your messages are parseable by automation tools while remaining human-readable for code reviewers.
You can perform deep audits of your project dependencies across multiple package ecosystems, identifying security vulnerabilities with CVSS scores, outdated versions, license incompatibilities, and unused packages. The skill generates a prioritized upgrade roadmap that balances security urgency, stability risk, and effort cost—helping you reduce supply chain risk and technical debt without destabilizing production.
You'll transform high-level feature requirements into a complete development plan covering API design, frontend implementation, testing strategy, and documentation. The skill helps you identify dependencies, parallelize work across frontend and backend teams, and establish quality gates that ensure features ship bug-free with proper error handling and logging.
You can rapidly design, optimize, and validate chromatographic and LC-MS/MS methods for analyzing drugs and metabolites in biological matrices. This skill guides you through analytical method development workflows—including parameter selection, sensitivity optimization, and regulatory strategy—while ensuring ICH Q2(R2) and FDA compliance throughout the development process.