Security Review Automation

Instructions

Use this skill to set up a lightweight security review loop around Claude Code.

1. Run an ad-hoc review before committing

• Update Claude Code to the latest version.
• In your repository, run the built-in command: /security-review.
• Review the findings and (optionally) ask Claude Code to implement fixes.

1. Add automated pull request reviews

• Install the Claude Code GitHub Action (see the post for the installation and configuration documentation).
• Configure rules to reduce false positives and align with your team’s security policy.
• Have the action comment on PR diffs with issues and recommended fixes.

1. Focus areas to request/check

• SQL injection risks
• Cross-site scripting (XSS)
• Authentication and authorization flaws
• Insecure data handling
• Dependency vulnerabilities

Examples

Example: Pre-commit check

• Run: /security-review
• Then ask Claude Code: “Fix the highest severity issues you found, and explain each change.”

Example: Pull request automation

• Add the GitHub Action and have it run on every PR.
• Tune rules to reduce noise.

Notes

• This skill is based on the Claude blog post (see source.json at the artifact root).
• The post references customization and installation documentation, but does not include a full workflow file or configuration snippet.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: uygnoey
• Source: uygnoey/skills-from-claude-blog
• License: MIT

Install and usage instructions live in the source repository linked above.