Claude Code For Code Review: The Security-Review Skill

The security-review skill walks the changed files in a session and checks for common security mistakes: input validation gaps, authentication flaws, hardcoded secrets, unsafe deserialization, SQL injection patterns, broken access control. It produces a structured report with severity ratings. It does not replace a security audit — it's a fast first pass.

What it's good at

1. 1Catching the obvious — secrets in code, missing input validation, unparameterized queries
2. 2Flagging changed code paths, not the whole repo (limits noise)
3. 3Producing structured output you can act on (severity + location + suggested fix)
4. 4Speed — runs in seconds on small diffs, not the hours a manual review takes
5. 5Consistency — the same diff produces similar findings each run, unlike one-off human reviews

What it misses

• Business logic flaws: 'this auth check is correct, but it lives in the wrong place'
• Cross-component vulnerabilities that span files it didn't read
• Anything that requires understanding the runtime environment
• Race conditions, timing attacks, side-channel issues
• Anything subtle enough that human security engineers debate it

Tuning the noise

Apply: weave it into your workflow

1. 1Run security-review on the next non-trivial PR you write
2. 2Triage every finding: act, defer with note, or false-positive
3. 3After three runs, tune CLAUDE.md to silence the chronic false positives
4. 4For real high-stakes code: still get a human security review on top

The big idea: the security-review skill is a useful second pair of eyes for the obvious mistakes. It is not a replacement for human security review on real-stakes code.