security-review: a Claude Code skill by Sentry
Official
For developers who want a security review of a file or diff that reports only confirmed, exploitable flaws. Skip it if you want every possible weakness listed or a live penetration test.
High-risk warning At least one scanner rated it high risk, so we keep it out of the top ten. Read its code before you install it.
- Score
- 74of 100
- Rank
- #138of 239
- Installs
- 23.2Kon skills.sh
- Security
- Warning 5 scanners
- Updated
- 2026
- Context
- ~81tokens always
Install
npx skills add https://github.com/getsentry/skills --skill security-review Run it in your terminal. View the source
Using the Claude app rather than Claude Code? You can add a skill there too. How to add it in the app
What does security-review do?
security-review is a skill from Sentry that has Claude audit code for exploitable vulnerabilities and report only high-confidence findings. It reports on the file or diff you name but researches the whole codebase first, tracing where each input comes from and whether framework escaping or validation already covers it. By code type it loads guides on injection, XSS, authorization, SSRF, cryptography, deserialization and more, plus Python and JavaScript language notes and a Docker guide. Values from settings or environment variables count as server-controlled. Output is a markdown report with severity, location, evidence and a fix for each finding, plus a separate list of items needing verification.
When should you use security-review?
Use it when
- You want a pull request checked for injection or XSS
- You want fewer false positives than a pattern scanner gives
- You are reviewing Django, Flask or Node code
Skip it when
- You want every theoretical weakness listed
- You need a penetration test of a live site
What it needs and what it can touch
What it can do
- Reads and searches the whole codebase
- Runs shell commands
- May start sub-agents (Task tool)
From reading its instructions, not from running it.
Why it scores 74
Strongest on upkeep (100 of 100), weakest on adoption (40).
Is security-review safe to install?
At least one scanner rated it high risk, so we keep it out of the top ten. Read its code before you install it. Scanners often miss what other scanners catch, and a skill can change after a scan. Read its source before you install it.
| Scanner | Result | Date |
|---|---|---|
| Gen Agent Trust Hub | Passed | Oct 24, 2026 |
| Socket | High risk | Oct 24, 2026 |
| Snyk | Low risk | Oct 24, 2026 |
| Runlayer | High risk | Feb 21, 2026 |
| ZeroLeaks | Low risk | Apr 16, 2026 |
Details
- Installs
- 23,194
- Repository stars
- 1,143
- Last repository change
- Tokens always loaded
- about 81
- Tokens when used
- about 2,848
- License
- Custom
- Data confidence
- High
Did it do the job for you?
Alternatives to security-review
All skills for this job-
Get security-auditsecurity-audit
For developers who want a source-based security review, from one question up to a full multi-agent audit.
-
Get penetration-testing-with-strixpenetration-testing-with-strix
For developers who want automated pentests that prove each finding with a working exploit.
-
Get security-and-hardeningsecurity-and-hardening
For web developers handling input, logins or personal data who want clear always, ask-first and never rules.
-
Get security-reviewsecurity-review
For web developers adding login, payments, uploads or new API routes who want a security checklist at hand.
security-review Get security-review