From lz-advisor
This skill should be used when the user wants a security-focused review of code, looking for vulnerabilities, attack surfaces, and threat patterns. Trigger phrases include "security review this code", "check for vulnerabilities", "audit security", "lz-advisor.security-review", "check for security issues", "threat model this code", "review for injection risks", "find vulnerabilities in", "security scan", "check for SQL injection", and "audit for security". This skill provides Opus-level security review at Sonnet cost by consulting the security-reviewer agent for OWASP Top 10-informed threat analysis. Findings are classified as Critical, High, or Medium with OWASP category tags. This skill should NOT be used for general code quality reviews, bug finding, or style issues -- use lz-advisor.review instead. It should also NOT be used for planning or implementing tasks -- use lz-advisor.plan or lz-advisor.execute instead.
How this skill is triggered — by the user, by Claude, or both
Slash command
/lz-advisor:lz-advisor.security-reviewThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
The lz-advisor:security-reviewer agent is backed by a stronger model (Opus)
The lz-advisor:security-reviewer agent is backed by a stronger model (Opus) with OWASP Top 10 expertise and threat modeling methodology. Invoke it via the Agent tool at the strategic moment described below. For guidance on timing and context packaging, see:
@${CLAUDE_PLUGIN_ROOT}/references/advisor-timing.md
@${CLAUDE_PLUGIN_ROOT}/references/context-packaging.md
This skill follows a three-phase workflow: scan, consult, then output.
## Phase 1: ScanDetermine the review scope from the user's request:
git diff or git log to identify changed files, then read themRead any CLAUDE.md files in the reviewed directories -- project guidelines inform what counts as a security concern and may include security-specific constraints.
Scan the code with a security-specific lens. Focus on:
Skip (do not flag):
Curate the top 3-5 highest-severity security findings with file:line references and relevant code context. For each finding, include an initial severity assessment (Critical / High / Medium).
Do not consult the security-reviewer agent during scanning. Scanning is preparation.
## Phase 2: Consult the Security ReviewerPackage the scan results and invoke the lz-advisor:security-reviewer
agent via the Agent tool. Package the consultation prompt per the
Verification template in
@${CLAUDE_PLUGIN_ROOT}/references/context-packaging.md. This is a
security-review consultation; the Threat Model Context block (assets the
code protects, who might attack it, blast radius) is REQUIRED, not
optional. The executor's 3-5 curated security findings become the
Findings section of the template (with OWASP category tags).
One security-reviewer consultation per review invocation. The security-reviewer starts with fresh context and cannot see the conversation -- all relevant context goes in the prompt.
## Phase 3: Structure OutputPresent findings to the user as console output.
Start with a summary header:
## Security Review Summary
Reviewed: [scope description -- files, directories, or change range]
Findings: [N] Critical, [N] High, [N] Medium
Then group findings by severity (Critical / High / Medium):
For each finding:
[A03 Injection])Include only findings the security reviewer validated. Drop findings the reviewer rejected.
Do not include:
If the reviewer identified attack chains, present them as a connected narrative across related findings -- for example, note how an input validation gap in one finding enables escalation through a privilege check bypass in another.
Present the security review findings to the user. If no security issues were found during scanning, report that no vulnerabilities were identified in the reviewed scope and note the security aspects that were examined.
npx claudepluginhub layzeedk/lz-advisor-claude-plugins --plugin lz-advisorCreates, edits, and optimizes skills for Claude Code, including drafting, evaluating with test prompts, iterating on performance, and improving skill descriptions for better triggering accuracy.