security-reviewer by jeffallan/claude-skills
npx skills add https://github.com/jeffallan/claude-skills --skill security-reviewer专注于代码审查、漏洞识别、渗透测试和基础设施安全的安全分析师。
semgrep --config=auto .
* bandit -r ./src
* gitleaks detect --source=.
* npm audit --audit-level=moderate
* trivy fs .广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
根据上下文加载详细指导:
| 主题 | 参考 | 加载时机 |
|---|---|---|
| SAST 工具 | references/sast-tools.md | 运行自动化扫描时 |
| 漏洞模式 | references/vulnerability-patterns.md | SQL 注入、XSS、手动审查时 |
| 密钥扫描 | references/secret-scanning.md | Gitleaks、查找硬编码密钥时 |
| 渗透测试 | references/penetration-testing.md | 主动测试、侦察、漏洞利用时 |
| 基础设施安全 | references/infrastructure-security.md | DevSecOps、云安全、合规性时 |
| 报告模板 | references/report-template.md | 编写安全报告时 |
ID: FIND-001
Severity: High (CVSS 8.1)
Title: SQL Injection in user search endpoint
File: src/api/users.py, line 42
Description: User-supplied input is concatenated directly into a SQL query without parameterization.
Impact: An attacker can read, modify, or delete database contents.
Remediation: Use parameterized queries or an ORM. Replace `cursor.execute(f"SELECT * FROM users WHERE name='{name}'")`
with `cursor.execute("SELECT * FROM users WHERE name=%s", (name,))`.
References: CWE-89, OWASP A03:2021
OWASP Top 10, CWE, Semgrep, Bandit, ESLint Security, gosec, npm audit, gitleaks, trufflehog, CVSS scoring, nmap, Burp Suite, sqlmap, Trivy, Checkov, HashiCorp Vault, AWS Security Hub, CIS benchmarks, SOC2, ISO27001
每周安装量
1.2K
代码仓库
GitHub 星标数
7.3K
首次出现
Jan 20, 2026
安全审计
安装于
codex967
opencode954
gemini-cli925
cursor924
claude-code916
github-copilot876
Security analyst specializing in code review, vulnerability identification, penetration testing, and infrastructure security.
semgrep --config=auto .bandit -r ./srcgitleaks detect --source=.npm audit --audit-level=moderatetrivy fs .Load detailed guidance based on context:
| Topic | Reference | Load When |
|---|---|---|
| SAST Tools | references/sast-tools.md | Running automated scans |
| Vulnerability Patterns | references/vulnerability-patterns.md | SQL injection, XSS, manual review |
| Secret Scanning | references/secret-scanning.md | Gitleaks, finding hardcoded secrets |
| Penetration Testing | references/penetration-testing.md | Active testing, reconnaissance, exploitation |
| Infrastructure Security | references/infrastructure-security.md |
ID: FIND-001
Severity: High (CVSS 8.1)
Title: SQL Injection in user search endpoint
File: src/api/users.py, line 42
Description: User-supplied input is concatenated directly into a SQL query without parameterization.
Impact: An attacker can read, modify, or delete database contents.
Remediation: Use parameterized queries or an ORM. Replace `cursor.execute(f"SELECT * FROM users WHERE name='{name}'")`
with `cursor.execute("SELECT * FROM users WHERE name=%s", (name,))`.
References: CWE-89, OWASP A03:2021
OWASP Top 10, CWE, Semgrep, Bandit, ESLint Security, gosec, npm audit, gitleaks, trufflehog, CVSS scoring, nmap, Burp Suite, sqlmap, Trivy, Checkov, HashiCorp Vault, AWS Security Hub, CIS benchmarks, SOC2, ISO27001
Weekly Installs
1.2K
Repository
GitHub Stars
7.3K
First Seen
Jan 20, 2026
Security Audits
Gen Agent Trust HubPassSocketWarnSnykWarn
Installed on
codex967
opencode954
gemini-cli925
cursor924
claude-code916
github-copilot876
Azure 升级评估与自动化工具 - 轻松迁移 Functions 计划、托管层级和 SKU
64,099 周安装
| DevSecOps, cloud security, compliance |
| Report Template | references/report-template.md | Writing security report |