Security review

Skill Karthick-Ramachandran/persist-os/.agents/skills/security-review

Local-first CLI that gives your repo durable, AI-ready memory - features, ADRs, modules, architecture, standards & tests and a deterministic doctor that validates health, evidence & drift.

Install

npx -y skills add Karthick-Ramachandran/persist-os --skill security-review

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

8 stars8 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

1.8 KB, as published. Nobody here has run it

Skill: Security Review

Purpose

Find security risks before a change is accepted.

Inputs

Change summary or diff.
Feature docs.
Architecture and security docs.
Test results.

Required Reading

docs/20-security/SECURITY_MODEL.md
docs/20-security/THREAT_MODEL.md
docs/10-architecture/FILE_WRITE_POLICY.md
docs/60-engineering/ENGINEERING_STANDARDS.md
docs/ai/MCP_STRATEGY.md

Output Files

Relevant feature REVIEW.md
Relevant feature COMPLETION_REPORT.md
Security docs, if the accepted behavior changes.

Process

Identify changed trust boundaries.
Check path validation, overwrite policy, symlink policy, and dry-run behavior.
Check dependency, package, template, and preset risk.
Check for network, telemetry, secrets, .env, cloud, AI API, or runtime MCP behavior.
Check tests for security-sensitive behavior.
Classify findings as blockers, risks, or documented acceptable tradeoffs.

Stop Conditions

Stop and request human decision if:

Runtime network, telemetry, cloud, MCP, AI API, auth, secrets, storage, or file write behavior changes without ADR or security review.
Existing files can be overwritten by default.
Writes can escape the project root.
Secrets could be read, logged, or generated into docs.
Engineering standards are bypassed for secrets, dependencies, migrations, tests, or completion evidence.

Quality Bar

Findings are specific and actionable.
Security claims cite docs or test evidence.
Remaining risks are explicit.