Can it generate visual security diagrams?

Yes, when using deep or expert analysis modes, the skill can generate Mermaid diagrams to help visualize trust boundaries and planned architectural components.

How do I trigger this skill in Claude Code?

You can trigger it by asking Claude to 'review plan for security', 'audit my design', or 'check my implementation plan for vulnerabilities' while providing your plan context.

What is a security plan review?

A security plan review is a proactive evaluation of a software design or implementation plan to identify potential security flaws and architectural risks before any code is actually written.

Why should I review my plan before coding?

Fixing architectural security issues during the design phase is estimated to be 10-100x cheaper than refactoring code or fixing vulnerabilities once the application is in production.

What security frameworks does this skill use?

This skill utilizes industry-standard methodologies including STRIDE threat modeling, data flow analysis, and checklists aligned with OWASP security principles.

AppSec Plan Reviewer

Name: AppSec Plan Reviewer
Author: florianbuetow

byflorianbuetow

•

Security & Testing

Analyzes implementation plans and architecture designs to identify security vulnerabilities before a single line of code is written.

The AppSec Plan Reviewer is a specialized security skill designed to catch architectural flaws and design-level vulnerabilities during the earliest stages of the development lifecycle. By shifting security 'left,' it identifies missing authentication models, data security gaps, and trust boundary issues when they are 10-100x cheaper to fix than after implementation. It supports multiple analysis depths—ranging from quick top-5 gap checks to expert-level STRIDE threat modeling—providing developers with actionable recommendations, risk assessments, and Mermaid diagrams to harden their software architecture before coding begins.

Key Features

01Automated security checklists for authentication, authorization, and data privacy

026 GitHub stars

03Pre-code security audits for implementation plans and architecture docs

04Structured reporting with Mermaid diagrams for visualizing trust boundaries

05Multi-level depth analysis including STRIDE-per-component threat modeling

06Actionable risk assessments with comparative cost-to-fix estimates

Use Cases

01Performing a quick security sanity check on an architectural proposal before starting a sprint

02Reviewing an implementation plan's data flow to ensure PII is handled securely

03Auditing a new feature's design document for potential authentication gaps

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add florianbuetow/claude-code review-plan

For use in Claude.ai and ChatGPT

Download Skill