code-security-review-pipeline plugin
Audit code changes for bugs, security flaws, and quality issues before merging.
How to install the code-security-review-pipeline plugin
Run both commands inside Claude Code. The first adds the marketplace once; the second installs the plugin.
/plugin marketplace add skillmds/SkillMD
/plugin install code-security-review-pipeline@skillmdWhat's inside code-security-review-pipeline
15 parts read from the plugin's own files.
Skills 15
Claude loads it when the task matches- ai-engineering-standards
Production-grade Python and AI engineering standards. Use for ANY Python work — FastAPI services, LangChain/LangGraph agents, RAG pipelines, LLM API integrations, document processing, or data scripts — whether writing new code, reviewing, refactoring, or debugging. Enforces typed Pydantic boundaries, structured errors and logging, LLM call timeouts/retries/output validation, secret management, async correctness, and tested code.
- api-security
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication, authorization, rate-limit, and CI/CD testing.
- apk-reverse
在 CLI 环境下做 Android APK 逆向时使用。适用于 APK 解包、Java 反编译、smali 修改、重打包、Frida 动态 Hook，以及按需切换到 so/native 分析。优先使用本机已安装的 jadx、apktool、frida、adb、ida-reverse、radare2。
- brooks-lint
AI code reviewer grounded in classic software engineering books for catching design smells, coupling issues, and architectural risks.
- caveman-review
Ultra-compressed code review comments. Cuts noise from PR feedback while preserving the actionable signal. Each comment is one line: location, problem, fix. Use when user says "review this PR", "code review", "review the diff", "/review", or invokes /caveman-review. Auto-triggers when reviewing pull requests.
- code-audit
Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.
- cred-omega
CISO operacional enterprise para gestao total de credenciais e segredos.
- dotnet-reverse
.NET / C# 二进制逆向。当目标是 .NET assembly（PE 头含 CLR、.exe/.dll 托管程序）、C# 编译产物（含 NativeAOT）、红队 Sharp* 工具（Rubeus / SharpHound / SharpHound 等）、.NET 混淆程序（ConfuserEx / SmartAssembly / Babel / Eazfuscator）、.NET loader / info-stealer / 套壳 malware 时使用。优先用 dnSpyEx + de4dot，需要 AI 直接操作时联动 dnSpy MCP。不用于纯 native 二进制（走 reverse-engineering / ida-reverse）。
- find-bugs
Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.
- fix-review
Verify fix commits address audit findings without new bugs
- logic-lens
AI-powered Claude Code skill that performs deep code review using formal logic and reasoning frameworks to detect bugs, anti-patterns, and security risks beyond what linters catch.
- reverse-engineering
Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.
- reverse-skill-router
Routes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct reverse-skill entrypoint is unclear.
- security-and-hardening
Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services.
- security-audit
Security audit of a codebase — web apps, APIs, services, CLI tools, libraries, daemons, and more. Use when asked to find security bugs, do a security review, audit for vulnerabilities, or pen-test the code. Focuses on exploitable issues with real impact, not theoretical concerns or industry-standard behavior.
Using code-security-review-pipeline in Claude Code
Skills need no command. Claude reads them when your request matches what they describe.
Update, turn off or remove
- Update the plugin (shell)
- claude plugin update code-security-review-pipeline@skillmd
- Refresh the marketplace
- /plugin marketplace update skillmd
- Turn it off for now
- /plugin disable code-security-review-pipeline@skillmd
- Remove it
- /plugin uninstall code-security-review-pipeline@skillmd
Skills in code-security-review-pipeline
- dotnet-reverseskillmds/SkillMD
.NET / C# 二进制逆向。当目标是 .NET assembly（PE 头含 CLR、.exe/.dll 托管程序）、C# 编译产物（含 NativeAOT）、红队 Sharp* 工具（Rubeus / SharpHound / SharpHound 等）、.NET 混淆程序（ConfuserEx / SmartAssembly / Babel / Eazfuscator）、.NET loader / info-stealer / 套壳 malware 时使用。优先用 dnSpyEx + de4dot，需要 AI 直接操作时联动 dnSpy MCP。不用于纯 native 二进制（走 reverse-engineering / ida-reverse）。
4 files144stars - reverse-engineeringskillmds/SkillMD
Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.
23 files144stars - api-securityskillmds/SkillMD
Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication, authorization, rate-limit, and CI/CD testing.
3 files144stars - apk-reverseskillmds/SkillMD
在 CLI 环境下做 Android APK 逆向时使用。适用于 APK 解包、Java 反编译、smali 修改、重打包、Frida 动态 Hook，以及按需切换到 so/native 分析。优先使用本机已安装的 jadx、apktool、frida、adb、ida-reverse、radare2。
12 files144stars - caveman-reviewskillmds/SkillMD
Ultra-compressed code review comments. Cuts noise from PR feedback while preserving the actionable signal. Each comment is one line: location, problem, fix. Use when user says "review this PR", "code review", "review the diff", "/review", or invokes /caveman-review. Auto-triggers when reviewing pull requests.
2 files144stars - reverse-skill-routerskillmds/SkillMD
Routes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct reverse-skill entrypoint is unclear.
64 files144stars - security-auditskillmds/SkillMD
Security audit of a codebase — web apps, APIs, services, CLI tools, libraries, daemons, and more. Use when asked to find security bugs, do a security review, audit for vulnerabilities, or pen-test the code. Focuses on exploitable issues with real impact, not theoretical concerns or industry-standard behavior.
20 files144stars - production-python-aiskillmds/SkillMD
Production-grade Python and AI engineering standards. Use for ANY Python work — FastAPI services, LangChain/LangGraph agents, RAG pipelines, LLM API integrations, document processing, or data scripts — whether writing new code, reviewing, refactoring, or debugging. Enforces typed Pydantic boundaries, structured errors and logging, LLM call timeouts/retries/output validation, secret management, async correctness, and tested code.
144stars - brooks-lintskillmds/SkillMD
AI code reviewer grounded in classic software engineering books for catching design smells, coupling issues, and architectural risks.
144stars - cred-omegaskillmds/SkillMD
CISO operacional enterprise para gestao total de credenciais e segredos.
144stars - find-bugsskillmds/SkillMD
Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.
144stars - logic-lensskillmds/SkillMD
AI-powered Claude Code skill that performs deep code review using formal logic and reasoning frameworks to detect bugs, anti-patterns, and security risks beyond what linters catch.
144stars - security-and-hardeningskillmds/SkillMD
Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. Use when building any feature that accepts untrusted data, manages user sessions, or interacts with third-party services.
144stars - code-auditskillmds/SkillMD
Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.
2 files144stars - fix-reviewskillmds/SkillMD
Verify fix commits address audit findings without new bugs
144stars
code-security-review-pipeline plugin questions
How do I install the code-security-review-pipeline plugin?
In Claude Code run /plugin marketplace add skillmds/SkillMD, then /plugin install code-security-review-pipeline@skillmd.
What does the code-security-review-pipeline plugin include?
code-security-review-pipeline bundles 15 skills.
How do I update or remove the code-security-review-pipeline plugin?
Update it with claude plugin update code-security-review-pipeline@skillmd in your shell, or from the Installed tab of /plugin. Remove it with /plugin uninstall code-security-review-pipeline@skillmd.