security-review · getsentry — Claude Code skill: code audit for vulnerabilities
Finds injections, XSS, authorization flaws, and other vulnerabilities in code. Reports only high-confidence findings.
npx skills add getsentry/skills --skill security-review -a claude-codeWhat security-review does
The skill checks code for SQL injection, XSS, SSRF, access control errors, unsafe deserialization, and other OWASP issues. Before flagging a pattern as vulnerable, it researches the codebase: where data comes from, whether validation exists, what framework protections apply. It does not flag test code, constants, values from settings or environment variables — only attacker-controlled input.
Inside: reference guides for Python, JavaScript, Docker, and links to OWASP checklists. The skill distinguishes server-controlled configuration (safe) from user input (needs review), and tells parameterized queries apart from string concatenation. For Django, React, and Vue it knows auto-escaping is on by default, and only flags explicit bypasses like |safe, dangerouslySetInnerHTML, or v-html with user input.
Requires Read, Grep, Glob, Bash, and Task tools — without them it cannot research the project. If your IDE lacks built-in skill support, you need the npx skills manager or a platform equivalent.
What it helps with
- check code for SQL injection and XSS
- find authorization flaws and insecure object access
- detect SSRF and unsafe deserialization
- tell real vulnerabilities from framework false positives
- get a report with confidence level for each finding
Example prompts for the agent
- security review this file for vulnerabilities
- run security-review on `api/views.py` and `frontend/components/UserProfile.tsx`
- find authorization issues in this endpoint
How to install security-review
1Skills CLI (Vercel)
npx skills add getsentry/skills --skill security-review -a claude-code2Manually: put the files in place
~/.claude/skills/security-review/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/security-review/
1Skills CLI (Vercel)
npx skills add getsentry/skills --skill security-review -a codex2Manually: put the files in place
.agents/skills/security-review/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add getsentry/skills --skill security-review -a cursor2Manually: put the files in place
.cursor/skills/security-review/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install getsentry/skills security-review2Manually: put the files in place
.github/skills/security-review/SKILL.md1Skills CLI (Vercel)
npx skills add getsentry/skills --skill security-review -a gemini-cli2Platform CLI
gemini skills install https://github.com/getsentry/skills --path skills/security-reviewManually: put the files in place
.devin/skills/security-review/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add getsentry/skills --skill security-review -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Other versions of security-review
Similar
Questions about security-review
How to install security-review in Claude Code?
Run npx skills add getsentry/skills --skill security-review -a claude-code. The skill will appear in ~/.claude/skills/security-review/SKILL.md.
What does security-review do?
It finds exploitable vulnerabilities: injections, XSS, access control errors, SSRF. Before reporting, it researches the codebase to filter out framework false positives and distinguish server configuration from user input.
What tools does security-review need?
The skill requires Read, Grep, Glob, Bash, and Task. Without them it cannot research the project and build confidence in findings.
