repo-security-review

KO | EN

gitlite — search

#cli #developer-tools #dotnet #framework #video #http #typescript #java #web #ui

repo-security-review

(★ 9)

A Claude Skill to perform security code review for repositories (code and Skill)

File Explorer

ZIP Download

- phase-llm-security.md
- phase0-topology.md
- phase1-secrets.md
- phase2-architecture.md
- phase2a-tech-stack.md
- phase3-dependencies.md
- phase4-owasp.md
- phase5-validate-and-poc.md
- phase6-report.md
- phase7-synthesis.md
- pr-review.md
- repo-security-review-command.md
- setup.sh
.gitignore
README.md
SKILL.md

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

A Claude Code **skill** that runs a full, multi-phase security review of a code repository — secret scanning, architecture and threat analysis, dependency CVEs, OWASP code review, and independent validation — then writes a single markdown report. Each phase runs as an isolated subagent, and findings pass through a finder → judgment trust boundary before they reach the report.

Works on a single repo or across multiple microservices, has a dedicated mode for auditing third-party/open-source tools before adopting them, and a fast diff-scoped mode for reviewing a single pull request without scanning the whole repo first.

> Full specification: [SKILL.md](SKILL.md).

---

## Installation

Skills live under `~/.claude/skills/`. Clone the repo there so updates are a `git pull` away:

```bash
mkdir -p ~/.claude/skills
git clone https://github.com/<your-org>/repo-security-review ~/.claude/skills/repo-security-review
```

Install the external scanners the phases use (`gitleaks`, `osv-scanner`, `semgrep`, `jq`, and optionally `docker` for `--runtime`):

```bash
bash ~/.claude/skills/repo-security-review/scripts/setup.sh
```

The script installs whatever it can via `brew`, `go`, or `pip3`. Any missing tool just degrades the matching phase — the pipeline never aborts. To update later: `cd ~/.claude/skills/repo-security-review && git pull`.

---

## Usage

In any Claude Code session (CLI or Desktop), point the skill at a local repo path:

```text
/repo-security-review /path/to/repo
```

### Sample commands

```text
# Skip phases you don't need, copy the report somewhere
/repo-security-review /path/to/repo --skip secrets,dependencies --output ~/reports/myapp

# Generate PoCs for confirmed findings
/repo-security-review /path/to/repo --poc

# Runtime PoC validation in Docker (implies --poc)
/repo-security-review /path/to/repo --runtime

# CI / headless — validation only (default: no PoC files), no prompts
/repo-security-review . --output ./security-report --yes

# Calibrate severity for a local-only tool, and verify the real deployment is auth-gated
/repo-security-review /path/to/repo --context deployment_target=local --verify-deployment https://app.example.com

# Multi-repo — analyze several services, get a system-level report
/repo-security-review --repos ~/svcs/auth,~/svcs/gateway,~/svcs/users --output ~/reports/my-system

# Vendor audit — is this third-party/open-source tool safe to adopt internally?
/repo-security-review /path/to/vendor-tool --vendor --output ~/reports/vendor-tool

# PR review — diff-scoped, no full-repo scan required first
/repo-security-review /path/to/repo --pr main...feature/add-export
```

### Flags

| Flag | Default | Effect |
|------|---------|--------|
| `--repos <paths>` | none | Comma-separated repo paths → multi-repo mode (adds cross-service topology + synthesis). |
| `--skip <phases>` | none | Comma-separated: `secrets`, `architecture`, `dependencies`, `owasp`, `skill-security`, `validation`. |
| `--output <dir>` | none | Copy the report and PoC scripts into this directory after the run (created if needed). |
| `--poc` | off | Opt-in: generate a PoC for each finding Phase 5 confirms. Without it, Phase 5 still validates every finding, but writes no PoC files. |
| `--runtime` | off | Stand the app up in Docker and run each confirmed PoC against it. Implies `--poc`. |
| `--vendor` | off | Third-party adoption audit. Skips secrets/dependencies, forces PoC generation off, pins all phases to Sonnet, and produces an adoption-risk report (verdict + conditions + "what it does" + adopter-side controls). |
| `--pr <base>...<head>` | none | PR review mode. Reviews only a pull request's diff — no full-repo scan needed first. `--pr <base>` is shorthand for `<base>...HEAD`. Pins to Sonnet, writes `pr-report.md`. Mutually exclusive with `--repos` and `--vendor`. |
| `--context <pairs>` | none | Inline threat model to calibrate severity: `deployment_target=local\|public`. Softens only — never sharpens. |
| `--verify-deployment <url>` | none | Opt-in: send one live, passive HTTP check to a real deployment URL so Phase 5 derives `auth_required_to_reach` from an actual observation (login/SSO redirect, WAF challenge) instead of a declared claim. Gated behind an explicit confirmation prompt (`--yes` auto-confirms). |
| `--yes` | off | Non-interactive / CI mode — auto-confirms prompts (safety path checks still apply). |
| `--cost` | off | Write `.security-review/cost-report.md` — duration and estimated token consumption for every phase that ran (and named subphases, e.g. 3b, Phase 5's PoC/Runtime parts). Renamed from `--debug`; no longer includes file-read/coverage/checks detail. |
| `--sonnet` | off | Apply Sonnet instead of Opus for phase2 to save some tokens in default scan mode. Often increases false negative and decreases false positive.|
| `--skill-security` | off | Opt-in: run Phase 4b (LLM/AI skill security) on a mixed repo that also contains a `SKILL.md`/`.claude/commands/`. Without it, a mixed repo never runs Phase 4b by default — just having those files present isn't reason enough, since ordinary `CLAUDE.md`/`AGENTS.md` docs are common in AI-assisted projects. Redundant on a repo that's *entirely* skill/agent content (Phase 4b auto-runs there regardless) and in `--vendor` mode (already auto-runs it). |
| `--help` | — | Show usage. |

**Skip cascades** (applied silently): `--skip owasp` also skips `validation` (and PoC generation has nothing left to run against); `--skip validation` means `--poc` has no effect; `--skip architecture` also skips `skill-security`. `--vendor` forces skip of `secrets` and `dependencies`, and forces PoC generation off regardless of `--poc`. In `--pr` mode the same skip names apply but target its own steps instead of numbered phases, and `architecture` cannot be skipped (its diff-scoped context is load-bearing for every other step); `--poc` has no effect in `--pr` mode.

### Output

Working artifacts go to `<repo>/.security-review/` (per-phase JSON, `pocs/`, and `final-report.md`); `--output` copies the report + PoCs out. In multi-repo mode, start from `system-report.md` in the output directory. In `--pr` mode, artifacts use `pr-`-prefixed filenames (`pr-findings.json`, `pr-validated.json`, `pr-report.md`) so they never collide with a prior or later full scan's output in the same repo.

---

## Phase flow

```mermaid
flowchart TD
    Start([/repo-security-review &lt;repo&gt;/]) --> P1

subgraph FINDER["FINDER LAYER (sequential subagents)"]
 P1[Phase 1 · Secret Scanning gitleaks + grep]
 P2a[Phase 2a · Tech Stack Detection standard-tier model manifest/grep extraction, not judgment]
 TS[(tech-stack.json)]
 P2[Phase 2 · Architectural Analysis deep-tier model · extended thinking reads tech-stack.json from Phase 2a]
 P3[Phase 3 · Dependency CVEs osv-scanner]
 P3b[Phase 3b · Reachability Validation]
 P4[Phase 4 · OWASP Code Scan semgrep + LLM]
 P4b[Phase 4b · LLM / AI Skill Security standard-tier model auto-activated for pure skill repos opt-in via --skill-security for mixed repos]

P1 --> P2a
        P2a --> TS
        TS --> P2
        P2 --> P3
        TS -. also read by .-> P3
        P3 --> P3b
        P3b --> P4
        TS -. also read by .-> P4
        TS -. skill_files .-> P4b
        P4 --> P4b
    end

P4b -. file path only .-> P5
    P2 -. file path only .-> P5

subgraph JUDGMENT["JUDGMENT LAYER (isolated context)"]
 P5[Phase 5 · Validate + PoC merges + validates Phase 4 findings and standalone Phase 2 findings verdict: Confirmed / Needs Review / Rejected PoCs only for Confirmed optional Docker runtime]
 end

P1 --> R[Phase 6 · Report Builder]
    P2 --> R
    P3b --> R
    P4b --> R
    P5 --> R
    R --> Out([final-report.md: Findings + Needs Review + False Positives, plus pocs/])

classDef finder fill:#eef6ff,stroke:#5b8def,color:#1a1a1a
    classDef judgment fill:#fff4e6,stroke:#e0883a,color:#1a1a1a
    classDef report fill:#e8f5e9,stroke:#5a9a5a,color:#1a1a1a
    classDef store fill:#f5f5f5,stroke:#888,color:#1a1a1a,stroke-dasharray: 3 3
    class P1,P2a,P2,P3,P3b,P4,P4b finder
    class P5 judgment
    class R report
    class TS store
```

PR review mode (`--pr`) is a separate, single-agent mode — not a variant of
the pipeline above. It never runs Phases 1–4 or 7; it runs
`references/pr-review.md` directly (Steps 0–5 gather diff-scoped context and
scan, Step 6 validates in isolation, Step 7 writes `pr-report.md`), bounding
file reads to the diff plus whatever a repo-wide grep specifically points to.

repo-security-review

Owner Repos

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

repo-security-review

Owner Repos

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

Download README