Continuous whitebox security auditing, OWASP governance, and token-optimized developer CLI & AI Agent toolkit.
security-review is a modern whitebox security review toolkit designed for AI-assisted development workflows and automated CI/CD pipelines.
- Developer CLI Accelerator: Fast git diff extraction, security entrypoint discovery, and report frontmatter validation.
- AI Agent Skills: Pre-engineered prompt contracts for full audits, staged reviews, branch diffs, plan reviews, and remediation tasks.
- Spec-Kit Extension: Separate extension commands (
speckit.security-review.*) and optional lifecycle hooks; the standalone CLI installer is not required.
Explore the interactive product showcase highlighting CLI terminal workflows, AI agent slash commands, and OWASP governance:
- Live Hosted Site: dyangalih.github.io/security-review
- Local Showcase File: landing/index.html
# Provision skills and governance config into your workspace
npx security-review initAutomatically detects and configures slash commands for Antigravity, Claude Code, Cursor, OpenCode, Codex, Gemini, and Goose.
Execute slash commands directly inside your AI coding assistant:
- Pre-commit review: Run
/sr-stagedto audit staged git changes before committing. - Full repository audit: Run
/sr-auditto evaluate the codebase against the OWASP 2025 standard. - Branch / PR review: Run
/sr-branchto review security regressions against the destination branch.
Tip
No separate LLM API keys are required. All security reasoning and threat modeling run directly within your AI assistant's session. For advanced standalone utilities, see the CLI Reference.
Use Security Review directly with AI coding assistants (Antigravity, Claude Code, Cursor, OpenCode, Codex):
| Slash Command | Skill ID | Development Phase | Purpose |
|---|---|---|---|
/sr-audit |
sr-audit |
Milestone / Audit | Full repository security audit across all OWASP categories. |
/sr-staged |
sr-staged |
Pre-commit | Focused security review of staged changes (git diff --cached). |
/sr-branch |
sr-branch |
Feature / PR | Review security risks introduced by the current feature branch. |
/sr-plan |
sr-plan |
Technical Design | Review technical plan for trust boundaries and security gaps. |
/sr-tasks |
sr-tasks |
Strategy & Tasks | Verify that security requirements are sequenced in implementation tasks. |
/sr-followup |
sr-followup |
Triage | Convert security findings into actionable remediation tasks. |
/sr-apply |
sr-apply |
Remediation | Automatically apply approved security fixes to tasks.md and plan.md. |
/sr-export |
sr-export |
Formal Report | Export formal Executive and Technical Pentest Report. |
/sr-verify |
sr-verify |
Verification & PoC | Re-verify findings, test client-side exploitability with Playwright E2E, and generate PoCs. |
/sr-init |
sr-init |
Onboarding | Initialize or update the project Security Constitution. |
👉 For full details on prompt contracts and agent workflows, see Agent Skills Guide.
If you are using Spec-Kit, Security Review can be added as an extension:
specify extension add security-review --from https://github.com/DyanGalih/security-review/archive/refs/tags/v2.1.0.zipExtension command IDs use speckit.security-review.*; the hooks are optional. Installing by name requires a catalog that contains this extension. OpenSpec projects use the standalone security-review init installer and bundled adapters.
👉 See the complete Spec-Kit Extension Guide for lifecycle hook configuration and command mappings.
- Installation Guide — Comprehensive install options
- CLI Reference — Command-line subcommands & flags
- Agent Skills Guide — AI Agent workflows & prompt engineering
- Spec-Kit Extension Guide — Spec-Kit integration & backward compatibility
- Field Registry — YAML frontmatter schema dictionary
- Usage & Lifecycle — End-to-end security review workflows
- Repository: https://github.com/DyanGalih/security-review
- License: MIT © DyanGalih
Security Review is inspired in part by the security-auditing approaches in Strix (Apache-2.0) and Cloudflare's security-audit-skill (MIT). These projects are independently licensed; Security Review remains MIT-licensed under its own LICENSE.