Perform security audits on code changes, diffs, or branches to find high-confidence exploitable vulnerabilities. Use when asked to "audit security", "review for vulnerabilities", "security scan", "check for security issues", "audit this PR", "review these changes for security", or "find vulnerabilit

Code Security Audit AI powered security audit for code changes with false positive filtering. Based on [claude code security review](https://github.com/anthropics/claude code security review). Bundled Resources Manual Audit Workflow Use this when auditing code changes directly (without CI scripts). 1. Gather Changes 2. Three Phase Analysis Phase 1 — Context Research: Identify security frameworks, ORMs, auth libraries, sanitization patterns, and trust boundaries in the codebase. Phase 2 — Comparative Analysis: Compare new code against established secure patterns. Flag deviations, inconsistencies, and new attack surfaces. Phase 3 — Vulnerability Assessment: Check each modified file for: Input Validation: SQL injection, command injection, XXE, template injection, NoSQL injection, path traversal Auth & Authz: Auth bypass, privilege escalation, session flaws, JWT vulnerabilities Crypto & Secrets: Hardcoded keys/tokens, weak algorithms, improper key storage Code Execution: RCE via deserialization, pickle/YAML injection, eval injection, XSS Data Exposure: Sensitive data logging, PII violations, API leakage, debug exposure Trace data flow from user inputs to sensitive operations. Look for privilege boundary crossings. 3. Filter False Positives Load [references/false positive filtering.md](references/false positive filtering.md) and apply all rules. Assign confidence 1 10 per finding; only keep findings with confidence ≥ 8. For domain specific categories, load [references/custom scan instructions.md](references/custom scan instructions.md). 4. Output Format GitHub Action Integration Run automated security audits on PRs via CI. Requires ANTHROPIC API KEY and GITHUB TOKEN . Setup Environment Variables Variable Required Purpose ANTHROPIC API KEY Yes Claude API access GITHUB TOKEN Yes GitHub API access for PR data GITHUB REPOSITORY Yes owner/repo format PR NUMBER Yes Pull request number EXCLUDE DIRECTORIES No Comma separated dirs to skip ENABLE CLAUDE FILTERING No true to use Claude API for FP filtering FALSE POSITIVE FILTERING INSTRUCTIONS No Path to custom filtering rules CUSTOM SECURITY SCAN INSTRUCTIONS No Path to custom scan categories Run Output is JSON with findings , analysis summary , and filtering summary . GitHub Actions Workflow PR Commenting Post findings as inline review comments: Reads findings.json from cwd. Requires GITHUB TOKEN and GITHUB EVENT PATH . Example Customization Files See references/ for sample customization files: references/custom false positive filtering.txt — Template for custom FP filtering rules references/custom security scan instructions.txt — Template for custom scan categories Evaluation Framework Test the audit against any public PR: Results saved to ./eval results/ as JSON with findings, runtime, and success status. Slash Command Copy [assets/security review command.md](assets/security review command.md) to .claude/commands/security review.md in any project to enable /security review in Claude Code. Key Principles 1. Minimize false positives — only flag issues with 80% confidence of exploitability 2. Skip noise — no theoretical issues, style concerns, or low impact findings 3. Focus on impact — prioritize unauthorized access, data breaches, system compromise 4. Only new issues — do not comment on pre existing security concerns 5. Better to miss theoretical issues than flood with false positives Severity Guidelines HIGH : Directly exploitable → RCE, data breach, auth bypass MEDIUM : Requires specific conditions but significant impact Do NOT report LOW severity findings

code-security-audit