agentleFS
Sign inStart free
Ecoa-PUC-RioEcoa-PUC-Rio/GAIDE/.claude/skills/security-reviewer/SKILL.md

security-reviewer

Skill8 starsChanged 3 months agoMITView on GitHub

Security review of the current diff (or PR) by a clean-context reviewer — logic-level flaws, authz reasoning, abuse-case coverage, and scanner-suppression audit. Use for changes touching auth, sensitive data, external input, or new dependencies, or when the user asks for a security review.

33 other projects use a version of this.

Adopted by

Most recently taken up by

Used with

Projects with it also use api-contract-reviewer, ddd-architect and 8 more.

Other files people use alongside this one.

Files found in the same public projects as a version of this one, more often than they turn up anywhere else. Each project counts once, large collections count for less, and this file's own repository is left out.
  • conectlensSkill

    api-contract-reviewer

    Review Supabase RPC/PostgREST API contracts for DTO correctness, response consistency, validation quality, and backward-compatibility risk. Use when changing libs/api/*, shared response types, or API-facing behavior.

    Also in 4 projects that use this

  • u9401066Skill

    ddd-architect

    Ensure code follows DDD architecture and DAL separation principles. Triggers: DDD, arch, 架構, 新功能, 新模組, new feature, scaffold, 骨架, domain.

    Also in 4 projects that use this

  • JohnJBorenSkill

    test-engineer

    Testing strategy, test patterns, and coverage optimization for unit, integration, and E2E tests

    Also in 3 projects that use this

  • JetBrainsSkill

    slides

    Create and edit presentation slide decks (`.pptx`) with PptxGenJS and render/validation utilities. Use when tasks involve building a new PowerPoint deck, recreating slides from screenshots/PDFs/reference decks, modifying slide content while preserving editable output, adding charts/diagrams/visuals, or diagnosing layout issues such as overflow, overlaps, and font substitution.

    Also in 3 projects that use this

  • lodetomasiSkill

    tdd-workflow

    Test-Driven Development workflow with red-green-refactor pattern and best practices

    Also in 3 projects that use this

  • StrayDragonSkill

    ui-ux-pro-max

    UI/UX design intelligence. 50 styles, 21 palettes, 50 font pairings, 20 charts, 8 stacks (React, Next.js, Vue, Svelte, SwiftUI, React Native, Flutter, Tailwind). Actions: plan, build, create, design, implement, review, fix, improve, optimize, enhance, refactor, check UI/UX code. Projects: website, landing page, dashboard, admin panel, e-commerce, SaaS, portfolio, blog, mobile app, .html, .tsx, .vue, .svelte. Elements: button, modal, navbar, sidebar, card, table, form, chart. Styles: glassmorphism, claymorphism, minimalism, brutalism, neumorphism, bento grid, dark mode, responsive, skeuomorphism, flat design. Topics: color palette, accessibility, animation, layout, typography, font pairing, spacing, hover, shadow, gradient.

    Also in 6 projects that use this

The file

We split this skill into the rules it gives an agent

1 rule. 0 are common, 1 is distinctive, and 0 are very specific to this project.

  • 0

    Common

    Most of the 29 edited versions we read keep these.

  • 1

    Distinctive

    This author's own choices. Worth a look.

  • 0

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Distinctive:

    Do not pass: summaries of the implementation conversation, assurances about which parts are safe, or justifications for suppressions.

    line 46

“Common” is measured: kept by at least 6 in 10 of the 29 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md
<!-- GENERATED from agents/skills/security-reviewer.md by scripts/sync-adapters.sh — edit the source and re-run; do not edit this file. -->

Skill: security-reviewer

Why this exists alongside the scanners

The hooks and CI already run semgrep, gitleaks, and osv-scanner — they catch pattern-level flaws. This review catches what scanners structurally cannot: authorization logic (IDOR, tenant isolation), abuse cases from the spec, and diffs that quietly disarm the scanners themselves. Like code-reviewer, it runs in a clean context — a reviewer following the rubric in agents/reviewers/security-reviewer.md that sees only the diff and the governing documents. In Claude Code this is the security-reviewer subagent; in tools without subagents, open a fresh conversation/agent given only the rubric and the brief below. Your job in this skill is orchestration, not judgment.

When to activate

  • The diff touches authentication, authorization, session handling, or crypto
  • The diff handles sensitive data (PII, financial, credentials) or new external input
  • A new dependency is introduced
  • A scanner finding was suppressed or a scanner config changed
  • The user explicitly asks for a security review

Playbook

1. Identify the review scope

git diff --staged   # if anything is staged
git diff            # otherwise, working tree

For an open PR, use gh pr diff <number>.

2. Locate the governing documents

  • specs/constitution.md (Principles 6 and 10 are the security anchors)
  • The feature's specs/<feature>/spec.md — its Security considerations section is the review contract
  • Relevant ADRs in docs/adr/

3. Spawn the reviewer with a minimal brief

Launch the clean-context reviewer (the security-reviewer subagent in Claude Code; elsewhere, a fresh conversation pointed at agents/reviewers/security-reviewer.md). Pass only:

  • How to collect the diff (the exact command from step 1)
  • The document paths from step 2

Do not pass: summaries of the implementation conversation, assurances about which parts are safe, or justifications for suppressions. If a suppression needs the author's private context to look legitimate, that is a finding.

4. Deliver the report

Present the subagent's report to the human verbatim — do not soften blockers, do not pre-answer findings. The human decides what to fix, dismiss, or justify.

Expected output

The subagent's structured Markdown report. Do not commit nor apply changes — this flow is read-only and advisory.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free