Initial security analysis
Skill JeremyMorgan/code-review-skills/skills/initial-security-analysis
Performs a first-pass security audit of project structure and attack surface to map risk and entry points. Use as the starting point for a security review.From its SKILL.md
npx -y skills add JeremyMorgan/code-review-skills --skill initial-security-analysisAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 12 stars12 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its file declares
Copied from the file, not written here
The file declares its own license as CC0-1.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
2.5 KB, as published. Nobody here has run it
Target: $ARGUMENTS
If no target path is given above, review the entire codebase.
Initial Project Analysis
Perform a Project Structure Audit
Analyze the entire project structure and identify:
- All entry points (app.js, server.js, etc.)
- All routes and endpoints
- Middleware chain and order
- External service integrations
- Database connection points
- Authentication/authorization flow
- File upload handling locations
- API rate limiting implementation
Start by detecting the tech stack (language, framework, package manager), then examine the core files appropriate for that stack:
- Node.js/Express:
package.json,app.js/server.js,routes/,middleware/ - Python (Django/Flask/FastAPI):
requirements.txt/pyproject.toml,settings.py/app.py, URL config, middleware config - Java/Spring:
pom.xml/build.gradle,application.properties, controller and filter/interceptor classes - Ruby/Rails:
Gemfile,config/routes.rb,app/controllers/,config/initializers/ - Go:
go.mod,main.go, router registration files - PHP/Laravel:
composer.json,routes/,app/Http/Middleware/,bootstrap/app.php
For other stacks, locate the equivalent dependency manifest, entry point, routing layer, and middleware chain.
Provide:
A structured finding report with the following for each issue:
Title, Severity (Critical/High/Medium/Low), CWE (if applicable), Evidence (file, function, line ranges), and a short Why it matters.
Exploitability notes and, where safe, a minimal PoC or reproduction steps (no real secrets).
Remediation: precise code-level fix or config change (snippets welcome), plus defense-in-depth guidance.
A summary risk score (0–10) and top 3–5 prioritized fixes that reduce risk fastest.
A checklist diff: which items from the “Check for” list are Pass/Fail/Not Applicable.
Constraints & style:
Be concrete and cite exact code locations and identifiers.
Prefer minimal, drop-in fix snippets over prose.
Do not invent files or functions that aren’t present; if context is missing, mark as Unable to verify and say what code would prove it.
Write this into a markdown file and place it in the audits/ folder.