mcpField
S
security-review

security-review

github.com/cosai-oasisSecurity35738 installsUpdated 2w ago
Repository

About security-review

A skill for conducting repository-wide security reviews and producing a prioritized Markdown report with findings and remediation guidance. It directs reviewers to load Project CodeGuard core rules and OWASP rules relevant to the repository's technology stack.

Key features

  1. 01Loads Project CodeGuard core security rules
  2. 02Selects OWASP rules for the detected stack
  3. 03Reviews code for listed security risk categories
  4. 04Produces prioritized findings and remediation guidance
  5. 05Saves a structured Markdown report

Use cases

  1. 01Review a repository for security vulnerabilities
  2. 02Prioritize findings and plan remediation
  3. 03Document reviewed files, applied rules, and methodology

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/cosai-oasis/project-codeguard --skill security-review

After installing, type/security-reviewin Claude Code to confirm it loaded.

Bundled filesSecurity_Code_Reviewer_Guidelines.md

Details

From the project README

Security Review

When to use

  • Use for a full codebase security review with prioritized findings, remediation guidance, and a formal report.

Inputs

  • Target repository path (first argument after invocation).
    • Example: $security-review /path/to/repo
  • Security knowledge base source:
    • Rules are sourced from Project CodeGuard, an open-source, model-agnostic security framework by CoSAI/OASIS.

If the repo path is missing or unclear, ask the user for it before proceeding.

Workflow

  1. Load the security knowledge base from Project CodeGuard

    • First read the Security_Code_Reviewer_Guidelines.md file bundled with this skill. Use its purpose and rule-loading strategy to guide the review.

    • Load all core security rules from Project CodeGuard:

      https://github.com/cosai-oasis/project-codeguard/tree/main/sources/rules/core

      These are mandatory foundational rules that must be loaded for every review.

    • Load relevant OWASP rules for the detected tech stack from:

      https://github.com/cosai-oasis/project-codeguard/tree/main/sources/rules/owasp

      Only load OWASP rules that match the target repository's technology stack.

  2. Perform deep code analysis

    • Review the repository line by line.
    • Focus on: injection flaws, authn/authz, hardcoded secrets, crypto misuse, SSRF, path traversal, RCE vectors, XSS/CSRF, unsafe deserialization, insecure defaults/configuration, and supply chain issues.

  3. Produce the report in markdown.

Report requirements

  • Executive Summary
    • Total findings by severity (Critical/High/Medium/Low/Info)
    • Top 5 most critical issues
    • Overall security posture
  • Detailed Findings (for each issue)
    • Title, Severity, Rule Reference(s), Location, Code Snippet
    • Description, Impact, Remediation (with examples), References
  • Findings by Category
  • Recommendations
    • Immediate actions, short-term (1-3 months), long-term improvements, tooling/process suggestions
  • Appendix
    • Files reviewed, rules applied/coverage, methodology notes

Output

  • Save the report to:
    • ./security_report/sec_review_<repo-name>_<YYYY-MM-DD_HH-mm-ss>.md
    • Use the target repo folder name for <repo-name> and replace spaces with -.
    • Write to the security_report folder in the current working directory.

Comments

Markdown supported