Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Review a design, PR, or feature for security issues before it ships. Use when asked to do a security review, security-review a change/PR, or check a feature for vulnerabilities. Produces a structured review across the common risk areas (authn/authz, input handling, secrets, data exposure, dependencies), findings ranked by severity with concrete fixes, and a ship / fix-first verdict. For code and systems you own or are authorized to review.
.claude/skills/mohitagw15856-security-review/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-02 | ✓→✗ | ▼ Worse | -37% | 0% |
| case-11 | ✓→✗ | ▼ Worse | 101% | 0% |
| case-15 | ✓→✗ | ▼ Worse | -13% | 0% |
| case-01 | ✓→✓ | ＝ Same ✓ | 2% | 0% |
| case-03 | ✓→✓ | ＝ Same ✓ | 1% | 0% |
A security review is a focused pass for the ways a change could be abused — before it reaches production. This skill reviews a design, PR, or feature against the recurring risk areas, ranks findings by severity, and gives a clear verdict with concrete fixes. It's for code/systems you own or are authorized to review, and it complements (not replaces) automated scanners and a formal pentest.
Ask for these only if they aren't already provided:
Summary & verdict — one-line read and a call: ✅ ship / 🔁 fix-first / ⛔ block, with the gating issue(s).
Review by risk area — scan each and note findings:
Findings (ranked) — each with severity, where, why it's exploitable, and the fix:
| Severity | Area | Finding (how it's exploited) | Fix | |---|---|---|---| | 🔴 Critical/High | | | | | 🟡 Medium | | | | | 🔵 Low / hardening | | | |
What's done well — controls already in place (so they're kept).
Follow-ups — anything needing a scanner, a pentest, or a deeper look.
Secure code/design review practice (OWASP Top 10 & ASVS risk areas, severity-ranked findings, actionable remediation).
| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-01 | pass→pass | 30,098 | 31,538 | +5% | 1 | 1 | 0% | 4,367 | 4,467 | +2% | 0 | 0 | — |
case-02 | pass→fail | 39,099 | 32,600 | -17% | 1 | 1 | 0% | 5,900 | 3,690 | -37% | 0 | 0 | — |
case-03 | pass→pass | 30,868 | 28,355 | -8% | 1 | 1 | 0% | 4,429 | 4,456 | +1% | 0 | 0 | — |
case-04 | pass→pass | 19,002 | 33,773 | +78% | 1 | 1 | 0% | 3,357 | 4,324 | +29% | 0 | 0 | — |
case-05 | pass→pass | 17,568 | 15,854 | -10% | 1 | 1 | 0% | 2,632 | 3,434 | +30% | 0 | 0 | — |
case-06 | pass→pass | 30,458 | 30,376 | -0% | 1 | 1 | 0% | 3,706 | 4,553 | +23% | 0 | 0 | — |
case-07 | pass→pass | 14,996 | 20,565 | +37% | 1 | 1 | 0% | 2,279 | 3,342 | +47% | 0 | 0 | — |
case-08 | pass→pass | 25,053 | 27,105 | +8% | 1 | 1 | 0% | 2,941 | 4,056 | +38% | 0 | 0 | — |
case-09 | pass→pass | 24,629 | 21,928 | -11% | 1 | 1 | 0% | 2,755 | 3,035 | +10% | 0 | 0 | — |
case-10 | pass→pass | 23,158 | 18,351 | -21% | 1 | 1 | 0% | 2,375 | 2,625 | +11% | 0 | 0 | — |
case-11 | pass→fail | 21,443 | 26,185 | +22% | 1 | 1 | 0% | 1,392 | 2,798 | +101% | 0 | 0 | — |
case-12 | pass→pass | 18,867 | 18,627 | -1% | 1 | 1 | 0% | 1,585 | 2,958 | +87% | 0 | 0 | — |
case-13 | fail→fail | 17,649 | 17,845 | +1% | 1 | 1 | 0% | 1,443 | 2,030 | +41% | 0 | 0 | — |
case-14 | pass→pass | 15,503 | 17,946 | +16% | 1 | 1 | 0% | 1,341 | 2,651 | +98% | 0 | 0 | — |
case-15 | pass→fail | 27,746 | 21,568 | -22% | 1 | 1 | 0% | 2,652 | 2,297 | -13% | 0 | 0 | — |
case-16 | pass→pass | 16,984 | 34,130 | +101% | 1 | 1 | 0% | 2,439 | 3,849 | +58% | 0 | 0 | — |
case-17 | pass→pass | 21,507 | 28,111 | +31% | 1 | 1 | 0% | 2,388 | 4,178 | +75% | 0 | 0 | — |
case-18 | pass→pass | 17,862 | 21,937 | +23% | 1 | 1 | 0% | 2,325 | 3,523 | +52% | 0 | 0 | — |
case-19 | pass→pass | 18,499 | 23,197 | +25% | 1 | 1 | 0% | 2,432 | 3,724 | +53% | 0 | 0 | — |
case-20 | pass→pass | 22,732 | 20,441 | -10% | 1 | 1 | 0% | 2,461 | 2,949 | +20% | 0 | 0 | — |
case-21 | fail→fail | 14,027 | 11,972 | -15% | 1 | 1 | 0% | 1,253 | 1,238 | -1% | 0 | 0 | — |
case-22 | pass→pass | 17,772 | 19,967 | +12% | 1 | 1 | 0% | 2,125 | 3,386 | +59% | 0 | 0 | — |
case-23 | pass→pass | 66,280 | 41,775 | -37% | 1 | 1 | 0% | 8,216 | 7,269 | -12% | 0 | 0 | — |
case-24 | pass→pass | 8,754 | 13,371 | +53% | 1 | 1 | 0% | 674 | 2,120 | +215% | 0 | 0 | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 24 cases were attempted. The headline lift of -100 percentage points is the difference between those two pass rates over the 24 comparable cases. 3 cases got worse with the skill loaded, and they are included in that figure.
Other measured skills in the registry, with their headline benchmark lift.