domains / families / security / security-review

security-review

combined

Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting. Runs a guided, end-to-end security review of a Power Pages site and consolidates every finding into one HTML report covering source code and dependencies, the live site, browser headers, firewall, authentication, and role-based permissions. Use when the user wants a full security review, a release-readiness check before publishing, a code-and-config check during development, live site monitoring, or asks open-ended questions like "review my site security", "is my site safe to ship", "do a security check", "monitor my site" — even if they do not name the individual checks.

When to use

• security review
• find vulnerabilities
• check for security issues
• audit security
• OWASP review
• review code for injection
• review code for XSS
• review code for authentication and authorization

When not to use

• test files
• dead code
• commented code
• documentation strings
• patterns using constants
• server-controlled configuration
• code paths requiring prior authentication

Skill page

Conflict

The two skills share the name 'security-review' but perform fundamentally different tasks. The microsoft/power-platform-skills copy is a guided, multi-phase orchestration skill for Power Pages that runs sub-skills (scan-code, scan-site, manage-firewall, etc.) and produces a consolidated HTML report. The getsentry/skills copy is a direct code-analysis skill that applies OWASP-based heuristics to source code to identify exploitable vulnerabilities with confidence-based reporting. They do not reproduce, shorten, or wrap each other; they are distinct procedures for different targets (Power Pages platform vs. general source code).