Is the Fortify Change Review skill free?

Yes. The skill itself is free from fortify/skills. SkillProof publishes the install command and an independent test verdict at no cost.

What is the Fortify Change Review SkillProof Score?

9.2/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 8/10, docs & honesty 5/5.

How do I install Fortify Change Review?

Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.

Can I use Fortify Change Review with Cursor, Copilot, Gemini CLI, Codex or other AI tools?

The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.

Fortify Change Review

Structured, AI-driven security review of a diff/PR against 18 Fortify vulnerability checklists.

by fortify · fortify/skills

Tested · Works

Install — copy the command Download source ↗

Test report

Verdict: Tested · Works
Score: 9.2/10
Tested: Jul 16, 2026
Environment: Claude Code 2.x (agent harness)
Upstream re-checked: Aug 10, 2026 · bf232dc

Ran it against a planted UserRepo.java with a concatenated-SQL search endpoint and an unauthenticated admin delete route: it correctly flagged both the ORDER BY/LIKE injection and a second injection point in the DELETE string most reviewers skip, each with file:line, attack path, and Fortify category ready to feed into SSC/FoD triage.

Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works

Installs cleanly 5/5
Triggers reliably 5/5
Output vs. baseline 8/10
Docs & honesty 5/5

What Fortify Change Review does

Maps a code change to the relevant Fortify security check files (injection, authZ, XXE, SSRF, IaC, crypto, etc.), applies each check's required agent actions, and emits a standardized 'Fortify Change Review' findings block with CWE/category, attack path, and recommendation per finding. Triggers on explicit 'Fortify security review' requests or when a diff touches auth, input handling, IaC, crypto, or similar sensitive surfaces; explicitly defers full SAST/DAST/SCA to other Fortify skills.

How to install Fortify Change Review

git clone https://github.com/fortify/skills
mkdir -p ~/.claude/skills
cp -r skills/skills/fortify-change-review ~/.claude/skills/fortify-change-review

Skills live in ~/.claude/skills/ (global) or .claude/skills/ (per-project). Restart Claude Code after installing.

Commands — how to trigger Fortify Change Review

/fortify-change-review Structured, AI-driven security review of a diff/PR against 18 Fortify vulnerability checklists.

It also activates on plain-language prompts like these:

Run a Fortify security review on this pull request diff before I merge
I added a login endpoint with token generation, check it for vulnerabilities
Review this Terraform change that creates an S3 bucket for security issues

Frequently asked questions

Is the Fortify Change Review skill free?: Yes. The skill itself is free from fortify/skills. SkillProof publishes the install command and an independent test verdict at no cost.
Does Fortify Change Review work with Claude Code?: We tested it with Claude Code 2.x (agent harness) on Jul 16, 2026. Verdict: Tested · Works. Ran it against a planted UserRepo.java with a concatenated-SQL search endpoint and an unauthenticated admin delete route: it correctly flagged both the ORDER BY/LIKE injection and a second injection point in the DELETE string most reviewers skip, each with file:line, attack path, and Fortify category ready to feed into SSC/FoD triage.
What is the Fortify Change Review SkillProof Score?: 9.2/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 8/10, docs & honesty 5/5.
How do I install Fortify Change Review?: Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
Can I use Fortify Change Review with Cursor, Copilot, Gemini CLI, Codex or other AI tools?: The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.