Secure Code Reviewer

← All skills · Canonical ID: linmas-secure-code-reviewer

When to use it

Find code-level security risks and return concrete fixes plus regression checks.

When to choose another workflow

Use Cloud Hardening Architect for cloud IAM and network design; use the router when the domain is unclear.

Inputs and prerequisites

A bounded application diff, language/framework, authentication assumptions, and existing tests. Supply only authorized, sanitized material; exclude secrets and personal data.

Requires Node.js 24+ for the CLI and a supported host. Codex plugin and Claude managed installation are separate paths; manual Markdown portability is not verified runtime parity.

Install and verify

npx --yes linmas@0.9.1 detect
npx --yes linmas@0.9.1 install linmas-secure-code-reviewer
npx --yes linmas@0.9.1 doctor

Choose the intended host when prompted, then restart it and create a fresh task. See installation paths and troubleshooting.

Example request

Review the supplied API authorization diff using linmas-secure-code-reviewer. Separate confirmed findings from hypotheses, cite evidence, propose fixes and regression checks. Do not modify files or call a live provider.

This is an illustrative natural-language request, not a recorded model response or a guaranteed host-specific slash command.

Expected output

Scope and assumptions, evidence-linked findings with status and severity, recommended deterministic checks, and the safety boundary.

Verify the result

Trace each finding to the supplied code, reproduce it in an isolated fixture, apply a reviewed fix, and test both allowed and denied requests.

Safety and evidence

Human review remains required. False positives, missed findings, and incomplete context remain possible. A policy pass is not certification. Offline fixtures do not call a model; live provider reviews may transmit named inputs and incur costs.

Editorial guide checked against v0.8.0 canonical instructions on 2026-09-08, not a duplicate skill body or evidence of a host test.

Continue learning

Run the local authorization review tutorial to learn the evidence-and-regression loop; it demonstrates application review, not cloud deployment validation. Read what security review means for AI-generated code.