skill-security-review

An agent skill that performs structured security reviews of automation skills, deployment plans, and live setups. It finds real risks — credential exposure, injection vectors, blast radius gaps, failure cascading — instead of rubber-stamping automation as “looks fine.”

The skill adopts the mindset of a senior cybersecurity analyst: it assumes the artifact under review will eventually be used under adversarial conditions, operated by a tired human against the wrong environment, and left in an inconsistent state by a partial failure. It finds these failure paths before they happen.

Install

npx skills add davethegut/security-review-skill

Works with Cursor, Claude Code, Codex, Windsurf, Cline, GitHub Copilot, Roo Code, and 40+ other agents.

How It Works

The skill runs a dual-pass review — a first-pass analysis followed by an independent second-pass validation from a separate AI agent with no prior context. This catches blind spots that a single reviewer would miss.

flowchart TD
    subgraph phase1 [Phase 1 -- Analysis]
        read[Step 1: Read artifact and all references]
        checklist[Step 2: Evaluate 7 checklist categories]
        failmodes[Step 3: Assess 10 failure modes]
        report[Step 4: Write first-pass report]
        read --> checklist --> failmodes --> report
    end

    subgraph phase2 [Phase 2 -- Independent Validation]
        spawn[Step 5: Spawn independent reviewer agent]
        merge[Step 6: Merge findings into final report]
        spawn --> merge
    end

    subgraph phase3 [Phase 3 -- Present]
        present[Step 7: Present consolidated findings]
    end

    invoke[User invokes skill] --> mode[Determine review mode]
    mode --> phase1
    phase1 --> phase2
    phase2 --> phase3

The independent second-pass agent reads the artifact fresh, validates checklist coverage, identifies missed issues, checks remediation quality, and flags disagreements with the first pass. Severity disagreements are resolved by taking the higher severity.

Review Modes

The skill auto-detects the mode based on the path or description you provide.

What Gets Checked

7 Checklist Categories (35+ individual checks)