Name: code-review-security
Rating: 68.8 (1 reviews)
Author: OWASP

code-review-security

Security-focused code review mapped to OWASP Top 10 and ASVS. Use when reviewing pull requests, auditing files or modules for vulnerabilities, or performing pre-merge security gate checks. Covers injection, auth, authorization, cryptography, data exposure, misconfiguration, and deserialization.

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A concise, well-structured security review checklist with a clear step sequence and concrete vulnerability-class coverage. Its main weaknesses are missing worked examples and referenced bundle files (plays/, templates/) that are not present, breaking progressive-disclosure navigation.

Suggestions

Add the referenced bundle files (plays/code-review-security.md and templates/finding.md) or inline the essential procedure so the skill is self-contained.

Include one short example finding (vulnerable snippet + fixed code) so the output format is unambiguous.

Add an explicit coverage-validation step before 'Produce Findings' (e.g. confirm each vulnerability class was considered) to add a feedback loop.

Dimension	Reasoning	Score
Conciseness	The body is lean and structured, listing vulnerability classes and steps without explaining concepts Claude already knows (e.g. it names XSS, SSTI, LDAP without defining them); every line earns its place, matching 'lean and efficient; assumes Claude's competence'.	5 / 5
Actionability	Gives concrete actionable guidance — specific vuln-class checklists, a named framework list, diff-specific checks, and a findings spec (cite file:line, show snippet, provide fixed code, rate confidence) — but no example finding or fixed-code snippet is shown and the detailed procedure is deferred to a referenced file, fitting 'mostly executable guidance; concrete guidance with minor gaps'.	4 / 5
Workflow Clarity	A clear five-step sequence (Scope, Systematic Review, Framework-Specific, Diff-Specific, Produce Findings) with some verification language ('verify security controls preserved'), but no explicit validation/feedback loop confirming coverage before emitting findings, fitting 'clear sequence with most checkpoints present; minor validation gaps'.	4 / 5
Progressive Disclosure	The body is well-sectioned and signals one-level-deep references ('follow the full procedure in plays/code-review-security.md', output uses 'templates/finding.md'), but those referenced files do not exist in the bundle (no plays/ or templates/ directories present), so navigation fails — 'some structure but could be better organized; references present but [the bundle backing them is incomplete]'.	3 / 5
	Total	16 / 20 Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that clearly states what the skill does and when to use it with concrete triggers and comprehensive vulnerability-class coverage. The only weakness is minor trigger-term synonym coverage and slight overlap with a general code-review skill.

Suggestions

Add natural synonyms users would say, such as 'security review' or 'PR security review', alongside 'pre-merge security gate checks'.

Sharpen the trigger to emphasize the security focus (e.g. 'Use when the user wants a security review of code') to reduce overlap with a general code-review skill.

Dimension	Reasoning	Score
Specificity	Names the domain (security code review mapped to OWASP Top 10 and ASVS) and lists multiple concrete actions plus a comprehensive set of vulnerability classes (injection, auth, authorization, cryptography, data exposure, misconfiguration, deserialization), matching the 'multiple specific concrete actions; comprehensive coverage' anchor.	5 / 5
Completeness	Explicitly answers both what (security-focused code review covering the listed vulnerability classes) and when via a concrete 'Use when reviewing pull requests, auditing files or modules for vulnerabilities, or performing pre-merge security gate checks' clause, matching the 'clearly and explicitly answers both what AND when with concrete trigger phrases' anchor.	5 / 5
Trigger Term Quality	Includes natural triggers like 'reviewing pull requests', 'auditing files or modules for vulnerabilities', and 'pre-merge security gate checks', but 'pre-merge security gate checks' is specialized jargon and common synonyms like 'security review' or 'PR review' are missing, fitting 'good keyword coverage; a few natural terms missing'.	4 / 5
Distinctiveness Conflict Risk	Carves a clear security niche with distinct triggers (OWASP, ASVS, security gate checks), but 'reviewing pull requests' overlaps with a general code-review skill, so it is 'mostly distinct; minor overlap risk with closely related skills' rather than minimal conflict risk.	4 / 5
	Total	18 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: OWASP/secure-agent-playbook
Path: plugins/code-security-skills/skills/code-review-security/SKILL.md
Commit: 79fea6b

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.