An automated security auditor that scans code changes for vulnerabilities, secrets, and insecure configurations based on OWASP standards.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install sn-security-review
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install sn-security-review using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Security Review Skill?
The Security Review skill is a specialized utility designed for Openclaw Skills to provide rigorous, automated security audits of code changes. It acts as a virtual security engineer that scrutinizes pull requests, commits, and local diffs to identify high-risk vulnerabilities before they reach production.
By integrating this skill into your development workflow, you ensure that every line of code is evaluated against the OWASP Top 10, industry-standard secure coding practices, and sensitive data exposure policies. It transforms standard code reviews into a security-first process by providing actionable remediation advice alongside identified risks.
Security Review Skill Use Cases
- Performing automated security audits during Pull Request reviews.
- Scanning new commits for hardcoded secrets, API keys, or credentials.
- Checking application logic for common injection flaws like SQLi, XSS, and Command Injection.
- Validating authentication and authorization implementations for potential bypasses.
How Security Review Skill Works
- The developer triggers the skill using commands like security review or check for vulnerabilities within the environment.
- The skill analyzes the provided code diff or specific files against a comprehensive checklist of security flaws.
- It categorizes findings based on severity, ranging from Low to Critical, while mapping them to specific OWASP categories.
- The agent generates a structured report including the problematic code snippet, an explanation of the risk, and a code-based fix.
- The developer reviews the findings and applies the suggested patches to secure the application.
Security Review Skill Setup
To enable this capability within your Openclaw Skills environment, ensure your agent has access to the skill definition and run the following in your terminal:
# Install the skill into your local agent configuration
openclaw install security-review
# Run a security check on your current git diff
openclaw run "security review"
Security Review Skill Data Schema & Taxonomy
The skill produces structured security reports for each identified vulnerability. The metadata and output are organized as follows:
| Attribute | Description |
|---|---|
| Severity | CRITICAL, HIGH, MEDIUM, or LOW ranking. |
| File/Line | Precise location of the vulnerability in the source code. |
| OWASP Ref | Specific category reference (e.g., A01:2021-Broken Access Control). |
| Remediation | Direct code examples showing how to patch the issue. |
Security Review Skill Advanced Features
- Multi-vector injection detection covering SQL, LDAP, and OS command execution.
- Comprehensive secrets detection for .env files, tokens, and hardcoded credentials.
- Analysis of configuration risks such as wildcard CORS policies and verbose error logging.
- Support for identifying IDOR (Insecure Direct Object Reference) and privilege escalation paths.
SKILL.md
Loading
Related Openclaw Skills
Growth-Share Matrix
A strategic business tool that classifies product portfolios into four quadrants based on market growth and relative market share to optimize investment decisions.
Novel Orchestrator
A sophisticated orchestration framework that coordinates a specialized team of AI agents to manage long-form web novel production from planning to final review.
Tapfiliate Integration Skill
An advanced integration for managing affiliate marketing programs, tracking conversions, and automating partner payouts via the Membrane framework.
Kaizen Continuous Improvement Reference
A comprehensive digital reference for implementing Kaizen events, PDCA cycles, and structured lean methodologies within any team or industrial environment.
Git Helper
An automation skill for managing Git repositories through standardized workflows and conventional commit enforcement.
Signup Flow CRO Skill
An expert conversion rate optimization skill designed to audit and streamline user registration processes to maximize acquisition.
Featured*
