cdmx-in/security-review

一项Claude代码技能，运行真实的安全扫描仪——然后核实所有发现与来源。

由Codemax IT Solutions Pvt. Ltd.建设和维护。

---

为什么会有这样的存在

Claude Code 已经发布了 /security-review，而且它在它擅长的领域——一个大型语言模型（LLM）方面表现不错 读取你分支的差异并对此进行推理。但它不会执行 扫描器。它无法读取你八个月前提交的密钥的 git 历史记录，它 不知道传递依赖有公开的CVE，且从未触及正在运行的 应用程序。

执行扫描仪的工具是单域的。Semgrep插件运行的是Semgrep。 gitleaks 技能运行 gitleaks。没人会协调所有这些技能，合并输出，然后杀掉 假阳性，并交出一份排名报告。

这正是这个空白所填补的。

---

Why this exists

Claude Code already ships /security-review, and it is good at what it does — an LLM reads the diff on your branch and reasons about it. What it does not do is execute a scanner. It cannot walk your git history for a key you committed eight months ago, it does not know a transitive dependency has a published CVE, and it never touches a running app.

The tools that do execute scanners are single-domain. The Semgrep plugin runs Semgrep. A gitleaks skill runs gitleaks. Nobody orchestrates all of them, merges the output, kills the false positives, and hands back one ranked report.

That gap is what this fills.

That division of labour is not stylistic. Measured on identical tasks, LLM review filters 36% of false positives when asked directly and 95% when given tools and structure. It is far better at refuting a finding than originating one — so the scanners originate.

Coverage