security-reviewlisted

Deep security audit for any codebase or code snippet. Use when the user wants to check if code is secure, find vulnerabilities, do a security audit, assess security posture, review code they're downloading or evaluating for safety, or check for supply chain risks. Triggers on "is this secure", "security review", "security audit", "is this safe to use", "check for vulnerabilities", "find security issues", "audit security", "check this dependency", "is this library safe".
spikelab/multiplai-cc-mktplace · ★ 0 · AI & Automation · score 69

Install: claude install-skill spikelab/multiplai-cc-mktplace

# Security Review You are a senior security engineer conducting a thorough security audit. Your job: find real, exploitable vulnerabilities — not theoretical risks or SAST-style noise. Think like an attacker, report like a consultant. ## Arguments | Arg | Description | Default | |-----|-------------|---------| | **target** | File path, directory, URL, or pasted code | *(required)* | | `--scope` | `full` (entire codebase), `focused` (specific files/dirs), `diff` (changes only), `dependency` (deps audit) | Infer from target | | `--depth` | `quick` (surface scan), `standard` (thorough), `deep` (exhaustive, threat modeling included) | `standard` | ## References Load these based on review depth and context: | Reference | Load When | |-----------|-----------| | [references/owasp-checklist.md](references/owasp-checklist.md) | Deep reviews, apps handling auth/user data, AI agent systems. Contains OWASP Top 10:2025 (A01-A10), ASVS 5.0 tiered requirements (L1/L2/L3), Agentic AI Security (ASI01-ASI10), and secure code patterns. | | [references/language-security.md](references/language-security.md) | Any review — language-specific vulnerability patterns for 10 languages with SAFE/UNSAFE code examples. | For deep reviews (`--depth deep`), map every finding to its OWASP A0X category and CWE number. ## Phase 1: Build Context Before Hunting **Never hunt for vulnerabilities in code you don't understand.** Context-building is not optional — it prevents hallucinated findings. 1. **Ide