security-review
보안 리뷰 수행. 취약점 점검, OWASP Top 10, 시크릿 노출, 의존성 보안 검토
When & Why to Use This Skill
This Claude skill automates comprehensive security reviews by identifying vulnerabilities, checking against the OWASP Top 10, detecting exposed secrets, and evaluating dependency security. It streamlines the security auditing process by analyzing code changes, identifying critical risks like SQL injection and XSS, and providing documented findings with severity levels to ensure robust software protection.
Use Cases
- Pre-merge security audits: Automatically analyze code changes for vulnerabilities such as SQL injection, XSS, and CSRF before they are merged into production branches.
- Secret and credential detection: Scan source code, configuration files, and environment variables to prevent the accidental exposure of API keys, tokens, and sensitive credentials.
- OWASP Top 10 compliance checking: Systematically verify web applications against the industry-standard OWASP Top 10 checklist to ensure adherence to security best practices.
- Dependency and supply chain security: Evaluate third-party libraries and dependencies for known vulnerabilities and insecure configurations to mitigate supply chain risks.
- Infrastructure and Docker security review: Inspect Dockerfiles and environment setups for security misconfigurations and data exposure risks.
| name | security-review |
|---|---|
| description | 보안 리뷰 수행. 취약점 점검, OWASP Top 10, 시크릿 노출, 의존성 보안 검토 |
| allowed-tools | Read, Grep, Glob, Bash |
Security Review
Instructions
- 변경된 모든 파일 식별
- 보안 이슈 분석:
- 노출된 자격 증명 또는 시크릿
- SQL 인젝션 취약점
- XSS 취약점
- CSRF 취약점
- 인증/인가 이슈
- 데이터 노출 위험
- 의존성 취약점 검사
- 환경 변수 처리 검토
- 심각도 레벨별 발견사항 문서화
Focus Areas
- 민감 파일 보호 (.env, keys)
- 입력 검증
- 출력 인코딩
- 암호화 사용
- API 보안
- Docker 보안 설정
OWASP Top 10 Checklist
- A01: Broken Access Control
- A02: Cryptographic Failures
- A03: Injection
- A04: Insecure Design
- A05: Security Misconfiguration
- A06: Vulnerable Components
- A07: Authentication Failures
- A08: Data Integrity Failures
- A09: Logging Failures
- A10: SSRF
Output Format
## Security Review Report
### Critical
- [심각한 이슈]
### High
- [높은 위험 이슈]
### Medium
- [중간 위험 이슈]
### Low
- [낮은 위험 이슈]
### Recommendations
- [권장 조치사항]