performing-security-code-review
について
このスキルは、Claudeがsecurity-agentプラグインを使用して自動化されたセキュリティコードレビューを実行できるようにします。SQLインジェクションやXSSなどの脆弱性を検出し、深刻度評価と修正ガイダンスを含む構造化された結果を提供します。セキュリティ監査を依頼する際や、コードのセキュリティ上の問題を確認する際にご利用ください。
クイックインストール
Claude Code
推奨/plugin add https://github.com/jeremylongshore/claude-code-plugins-plusgit clone https://github.com/jeremylongshore/claude-code-plugins-plus.git ~/.claude/skills/performing-security-code-reviewこのコマンドをClaude Codeにコピー＆ペーストしてスキルをインストールします
ドキュメント
Overview
This skill empowers Claude to act as a security expert, identifying and explaining potential vulnerabilities within code. It leverages the security-agent plugin to provide detailed security analysis, helping developers improve the security posture of their applications.
How It Works
- Receiving Request: Claude identifies a user's request for a security review or audit of code.
- Activating Security Agent: Claude invokes the security-agent plugin to analyze the provided code.
- Generating Security Report: The security-agent produces a structured report detailing identified vulnerabilities, their severity, affected code locations, and recommended remediation steps.
When to Use This Skill
This skill activates when you need to:
- Review code for security vulnerabilities.
- Perform a security audit of a codebase.
- Identify potential security risks in a software application.
Examples
Example 1: Identifying SQL Injection Vulnerability
User request: "Please review this database query code for SQL injection vulnerabilities."
The skill will:
- Activate the security-agent plugin to analyze the database query code.
- Generate a report identifying potential SQL injection vulnerabilities, including the vulnerable code snippet, its severity, and suggested remediation, such as using parameterized queries.
Example 2: Checking for Insecure Dependencies
User request: "Can you check this project's dependencies for known security vulnerabilities?"
The skill will:
- Utilize the security-agent plugin to scan the project's dependencies against known vulnerability databases.
- Produce a report listing any vulnerable dependencies, their Common Vulnerabilities and Exposures (CVE) identifiers, and recommendations for updating to secure versions.
Best Practices
- Specificity: Provide the exact code or project you want reviewed.
- Context: Clearly state the security concerns you have regarding the code.
- Iteration: Use the findings to address vulnerabilities and request further reviews.
Integration
This skill integrates with Claude's code understanding capabilities and leverages the security-agent plugin to provide specialized security analysis. It can be used in conjunction with other code analysis tools to provide a comprehensive assessment of code quality and security.
GitHub リポジトリ
関連スキル
content-collections
メタThis skill provides a production-tested setup for Content Collections, a TypeScript-first tool that transforms Markdown/MDX files into type-safe data collections with Zod validation. Use it when building blogs, documentation sites, or content-heavy Vite + React applications to ensure type safety and automatic content validation. It covers everything from Vite plugin configuration and MDX compilation to deployment optimization and schema validation.
creating-opencode-plugins
メタThis skill provides the structure and API specifications for creating OpenCode plugins that hook into 25+ event types like commands, files, and LSP operations. It offers implementation patterns for JavaScript/TypeScript modules that intercept and extend the AI assistant's lifecycle. Use it when you need to build event-driven plugins for monitoring, custom handling, or extending OpenCode's capabilities.
evaluating-llms-harness
テストThis Claude Skill runs the lm-evaluation-harness to benchmark LLMs across 60+ standardized academic tasks like MMLU and GSM8K. It's designed for developers to compare model quality, track training progress, or report academic results. The tool supports various backends including HuggingFace and vLLM models.
sglang
メタSGLang is a high-performance LLM serving framework that specializes in fast, structured generation for JSON, regex, and agentic workflows using its RadixAttention prefix caching. It delivers significantly faster inference, especially for tasks with repeated prefixes, making it ideal for complex, structured outputs and multi-turn conversations. Choose SGLang over alternatives like vLLM when you need constrained decoding or are building applications with extensive prefix sharing.