How to use the Security Reviewer agent skill

What is an agent skill and what does this one do?

An agent skill is a set of instructions and supporting files that an AI agent reads when a request matches the skill's description. The skill tells the agent how to approach a specific kind of task.

The security-reviewer skill sets the agent up to identify security vulnerabilities, generate audit reports with severity ratings, and suggest fixes. Its description covers SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, and compliance checks.

• Follows a five-stage workflow: scope, scan, review, test and classify, report.
• Runs example scanners such as Semgrep, Bandit, gitleaks, npm audit and Trivy.
• Reviews authentication, input handling and cryptography by hand, because scanners miss context.
• Rates each finding as Critical, High, Medium, Low or Info using CVSS.
• Writes each finding with its location, impact and remediation, and loads reference notes when relevant.

How do you install the Security Reviewer skill?

Download the skill as a ZIP from this page and unzip it. You can install it in one of two ways.

For Claude Code, unzip the folder into ~/.claude/skills/ to make it available across your projects, or into a project's .claude/skills/ folder to limit it to that project. For the Claude apps, open Settings, go to Capabilities, and upload the skill under Skills.

After installing, check that the folder contains SKILL.md and the references/ folder. Those files are what the agent reads.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project
• Claude apps: Settings → Capabilities → Skills, then upload

How do you trigger the skill with natural requests?

You do not need a special command. Describe the task in plain language, and the agent will load the skill when your request matches its triggers. The skill's listed triggers include security review, vulnerability scan, SAST, security audit, penetration test, code audit, infrastructure security, DevSecOps, cloud security and compliance audit.

Be specific about the target and the output you want. Naming the folder or service helps the agent scope the review, and asking for a report tells it which template to use.

• "Do a security review of the payments module in ./src and write a report."
• "Run a SAST scan on this repository and rate the findings by severity."
• "Check this project for hardcoded secrets and tell me how to remove them."
• "Review our Terraform in terraform/ for cloud security issues."
• "Audit our npm dependencies and prioritize what to fix first."

What does a typical review look like?

The agent first maps the attack surface and critical paths, and confirms written authorization before any active testing. It then runs the scanners available on your machine. For example, it may run semgrep --config=auto . on the code, gitleaks detect --source=. for secrets, and npm audit --audit-level=moderate for dependencies.

After the scans, the agent reviews authentication, input handling and cryptography by hand. It then classifies each validated finding and produces a report. Each finding follows a fixed layout with an ID, severity and CVSS score, file and line, description, impact, remediation and references, such as CWE or OWASP identifiers.

• Output includes an executive summary, a findings table with severity counts, detailed findings and prioritized recommendations.
• Findings are meant to be confirmed with stakeholders before the report is finalized.
• Critical findings are to be reported immediately rather than held for the final report.

What do you need before you start?

The skill does not ship the scanners. It assumes the tools the agent calls are installed on your machine. The SKILL.md lists semgrep, bandit, gitleaks, npm and trivy as example commands, so install whichever ones match your stack. The knowledge section also mentions nmap, Burp Suite and sqlmap, but the files shown do not require them.

The skill runs scripts and uses the network, so the agent may execute commands and reach external services during a review.

• Scanners the agent will call, such as semgrep, bandit, gitleaks, npm and trivy, installed locally.
• Optional: nmap, Burp Suite and sqlmap for penetration-testing references.
• Access to the code or system you are reviewing.

What safety rules should you know?

Do not use this skill against live or production systems without written authorization. The skill's own rules require scope approval before active testing, and the agent could still be pointed at systems you do not own, so check the target yourself first.

The skill's rules also say to exploit no further than proof of concept, to avoid service disruption or data loss, to test only inside the defined scope, and to not share detailed exploits publicly. Because the skill can run scripts and make network requests, review commands the agent proposes before approving them, especially for active scans.

• Get written authorization and define scope before any active testing.
• Stay within proof of concept and avoid disruption or data loss.
• Keep detailed exploit details private.
• Read proposed commands before letting the agent run them.

Tips for getting better results

Give the agent the scanners you already use and the stack you are working in, so it runs the right tools. Ask for a report in the template format when you need something to share with stakeholders.

Treat the output as a strong first pass. The skill itself says tools miss context and manual review is mandatory, so verify each finding and do not drop low-severity issues without a reason.

• Ask for triage of existing scanner output to get clear remediation steps.
• Ask for a compliance checklist when you are preparing an audit.
• Run the review before release, when fixes are cheapest.