security-review: Claude Code Skill & Agent Tool
An open-source skill by getsentry (opens in a new tab), published in the getsentry/skills (opens in a new tab) repository on GitHub. Sentry's systematic security code review for injection, XSS, authentication, authorization and cryptography issues, with confidence levels that keep false positives out of the report.
Install security-review
Requires Node.jsnpx skills add getsentry/skills --skill security-reviewRun this command in your project terminal to install this skill for Claude Code.
What this skill does
security-review is Sentry's systematic security code review skill. It activates when you ask your agent for a security review, an OWASP review or a search for vulnerabilities, and it covers injection, cross-site scripting, authentication, authorization, cryptography and exposed secrets.
Its defining trait is confidence-based reporting. A finding is reported only when the vulnerable pattern and attacker-controlled input are both confirmed; when the input source is unclear, the issue is listed under Needs verification; theoretical and defense-in-depth remarks are not reported at all. A Do not flag section keeps out the usual false positives, such as values controlled by server settings or patterns your framework already mitigates. SSRF, path traversal, open redirects and weak cryptography are flagged only after checking where the data comes from.
The review process is methodical: detect the context, load the guide for your language and infrastructure, research before flagging, verify exploitability, and report high-confidence issues with a severity. The output is a clear report per file or component, with a summary and its findings. Use it with Claude Code on a pull request, before a release, or when you take over an unfamiliar codebase.
Key Capabilities
- Covers injection, XSS, authentication, authorization, cryptography and secrets
- Confidence levels: reports only confirmed issues and marks unclear ones for verification
- Do-not-flag rules for server-controlled values and framework-mitigated patterns
- Loads language and infrastructure guides for your stack
- Report per file or component, with severity and summary
How to use with Claude Code & AI Agents
Install the skill
Run the command above at the root of your project. The CLI asks which agents to set up — Claude Code, Cursor and other supported agents — and adds security-review to the project, so teammates who pull the repository get it too. Add-gto install it for your user account across every project.Open a new agent session
Start a fresh Claude Code session in that project so the agent loads the new skill. This skill needs no extra tool or API key.Ask in plain words
Describe the task, for example:“Do a security review of the authentication and payment code in this repo.”The agent matches your request to the skill's description and follows its SKILL.md instructions step by step. Read them on GitHub before using the skill on a system that matters.