skill-security-review

An agent skill that performs structured security reviews of automation skills, deployment plans, and live setups. It finds real risks — credential exposure, injection vectors, blast radius gaps, failure cascading — instead of rubber-stamping automation as “looks fine.”

The skill adopts the mindset of a senior cybersecurity analyst: it assumes the artifact under review will eventually be used under adversarial conditions, operated by a tired human against the wrong environment, and left in an inconsistent state by a partial failure. It finds these failure paths before they happen.

Install

npx skills add davethegut/security-review-skill

Works with Cursor, Claude Code, Codex, Windsurf, Cline, GitHub Copilot, Roo Code, and 40+ other agents.

How It Works

The skill runs a dual-pass review — a first-pass analysis followed by an independent second-pass validation from a separate AI agent with no prior context. This catches blind spots that a single reviewer would miss.

flowchart TD
    subgraph phase1 [Phase 1 -- Analysis]
        read[Step 1: Read artifact and all references]
        checklist[Step 2: Evaluate 7 checklist categories]
        failmodes[Step 3: Assess 10 failure modes]
        report[Step 4: Write first-pass report]
        read --> checklist --> failmodes --> report
    end

    subgraph phase2 [Phase 2 -- Independent Validation]
        spawn[Step 5: Spawn independent reviewer agent]
        merge[Step 6: Merge findings into final report]
        spawn --> merge
    end

    subgraph phase3 [Phase 3 -- Present]
        present[Step 7: Present consolidated findings]
    end

    invoke[User invokes skill] --> mode[Determine review mode]
    mode --> phase1
    phase1 --> phase2
    phase2 --> phase3

The independent second-pass agent reads the artifact fresh, validates checklist coverage, identifies missed issues, checks remediation quality, and flags disagreements with the first pass. Severity disagreements are resolved by taking the higher severity.

Review Modes

The skill auto-detects the mode based on the path or description you provide.

What Gets Checked

7 Checklist Categories (35+ individual checks)

Each check has a defined severity level and detailed evaluation criteria. The full checklist is in references/review-checklist.md.

10 Common Failure Modes

Structural patterns that create systemic risk over time. These go beyond individual checks — they evaluate how the system behaves at scale, under adversarial conditions, and over time. The full guide is in references/common-failure-modes.md.

Severity Levels

When in doubt, the skill uses the higher severity. It is better to over-flag and let you downgrade than to miss a real issue.

Installation

Via skills.sh (recommended)

npx skills add davethegut/security-review-skill

The CLI auto-detects which agents you have installed and offers to install to each one. Use flags for non-interactive installation:

# Install to a specific agent
npx skills add davethegut/security-review-skill -a cursor -y

# Install globally (available to all projects)
npx skills add davethegut/security-review-skill -g

# Install to all detected agents
npx skills add davethegut/security-review-skill --all

Manual installation

Clone the repo and copy into your agent’s skills directory:

git clone https://github.com/davethegut/security-review-skill.git

# Cursor
cp -r security-review-skill ~/.cursor/skills/skill-security-review

# Claude Code
cp -r security-review-skill ~/.claude/skills/skill-security-review

# Or any agent's skills directory

Verify installation

Confirm that SKILL.md is readable at the installed path and that the references/ directory contains the three reference files (review-checklist.md, common-failure-modes.md, review-template.md).

Usage

Point the skill at the artifact you want reviewed. How you invoke it depends on your agent:

Skill Review

Review the skill at skills/my-automation/SKILL.md

Deployment Plan Review

Review the deployment plan at docs/infrastructure-plan.md

Post-Deployment Audit

Audit the current security setup based on this config: [paste config]

What to Expect

1. The skill reads the target artifact and all files it references (scripts, configs, .env patterns)
2. It evaluates against all 7 checklist categories and 10 failure modes
3. It writes a first-pass report to work_docs/reviews/security-review-{name}-{date}.md
4. It spawns an independent reviewer agent that re-reads the artifact from scratch
5. The second-pass findings are merged into the final report
6. You receive a summary with overall risk level, top findings, and prioritized remediations

Output Format

Reviews are written as structured markdown reports. The template is in references/review-template.md. Each report includes:

• Risk Summary — overall risk level, counts of findings by severity, write operations identified, credential exposure points
• First-Pass Findings — each finding with checklist reference, file location, description, risk assessment, and actionable remediation
• Failure Mode Assessment — table evaluating all 10 structural failure patterns (Yes / Partial / No)
• Second-Pass Review — independent agent’s coverage validation, additional findings, remediation validation, and disagreements
• Consolidated Recommendations — priority-ordered action items merging both passes

See examples/sample-review-output.md for a real review report.

Customization

The skill’s knowledge is fully contained in editable markdown files. You can extend it without modifying SKILL.md.

Adding checklist items

Edit references/review-checklist.md. Add new checks to an existing category or create a new category (category 8+). Follow the existing format:

| 8.1 | Your new check description | SEVERITY | Detailed evaluation criteria |

Adding failure modes

Edit references/common-failure-modes.md. Add a new numbered section following the existing pattern (title, “Pattern”, “Why it fails”, “What to check”, “Good pattern”).

Modifying the report template

Edit references/review-template.md to change the output structure. The skill reads this template at runtime, so changes take effect immediately.

Adjusting severity thresholds

The severity guidelines in SKILL.md can be adjusted to match your organization’s risk tolerance. The “when in doubt, use the higher severity” default can be changed to match your preferred approach.

Limitations

• Does not fix issues. It identifies and documents them with remediations. You decide what to act on.
• Does not run scripts or commands against live systems. The review is entirely read-only analysis.
• Does not validate that scripts actually work. It evaluates whether their design is secure, not whether they execute correctly.
• Does not replace a formal penetration test or security audit. This is a design-time review tool, not a runtime security scanner.

Repository Structure

├── SKILL.md                          # Main skill definition — workflow, modes, severity guidelines
├── references/
│   ├── review-checklist.md           # 7 categories, 35+ security checks with severity levels
│   ├── common-failure-modes.md       # 10 structural failure patterns
│   └── review-template.md           # Standardized report output template
└── examples/
    └── sample-review-output.md       # Real review report (anonymized)

License

MIT