security-review

Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting.

1.11x

Quality

88%

Does it follow best practices?

Impact

97%

1.11x

Average score across 3 eval scenarios

Securityby

High

Do not use without reviewing

Evaluation results

91%

Security Review: Django API Endpoint

False positive avoidance in Django codebase

Criteria

Baseline

With context

Raw SQL injection flagged

100%

mark_safe XSS flagged

100%

User-URL SSRF flagged

100%

Settings-based URL not flagged

57%

100%

Env var not flagged

70%

10%

Settings path not flagged

100%

Path traversal with report_type flagged

100%

Correct output format

14%

100%

Finding fields present

57%

100%

Security Review: Node.js Backend Service

Always-flag patterns and severity classification

Criteria

Baseline

With context

eval flagged as Critical

100%

child_process.exec flagged

100%

Hardcoded STRIPE_SECRET_KEY flagged

100%

Hardcoded webhook secret flagged

100%

dangerouslySetInnerHTML flagged

100%

React JSX interpolation not flagged

100%

Severity classification correct

100%

VULN-NNN format used

85%

100%

Summary section present

71%

100%

17%

Security Review: Python Authentication Service

Confidence-based reporting and weak crypto context

Criteria

Baseline

With context

MD5 for passwords flagged

100%

random for session token flagged

100%

MD5 for file checksum not flagged

33%

100%

Path traversal flagged

100%

Env-var base URL not flagged as SSRF

100%

IDP token URL noted or flagged

100%

Needs Verification section present

60%

100%

Correct output format

28%

100%

Fix suggestions included

100%

Repository: joe-bell/cva
Path: .agents/skills/security-review/SKILL.md
Commit: 170f233

Evaluated: 5 months ago
Agent: Claude Code
Model: Claude Sonnet 4.6

Table of Contents

Security Review: Django API Endpoint Security Review: Node.js Backend Service Security Review: Python Authentication Service

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.