Security review
21 markdown-first software delivery workflow skills for Claude Code, Codex, and compatible agents. Standalone skill kit covering planning, debugging, CI, review, security, rollout, performance, data quality, and post-incident workflows.
npx -y skills add motao123/dev-workflow-kit --skill security-reviewAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Use when a change affects trust boundaries such as authentication, authorization, untrusted input, secrets, or sensitive data handling. This skill identifies security risks, abuse cases, and verification steps without replacing implementation review.
The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
1.8 KB, as published. Nobody here has run it
Security Review
Use this skill when a change could introduce or expose security-sensitive behavior.
Trigger Conditions
Use this skill when:
- auth or permission logic changes
- user-controlled input reaches storage, commands, templates, or queries
- secrets, tokens, uploads, redirects, or external callbacks are involved
- the user asks for a security pass before merge
- a feature creates new trust boundaries or expands existing ones
Do not use this skill as a generic code-quality pass when no security surface is involved.
Workflow
- Identify assets, trust boundaries, and user-controlled inputs.
- Map the relevant attack surfaces.
- Check for common failure modes such as injection, exposure, broken access control, and unsafe defaults.
- Rate the likely severity and exploitability.
- Recommend the smallest effective mitigations.
- Suggest verification for the mitigations.
Output
For non-trivial work, provide:
- surfaces reviewed
- risks found
- severity or priority
- mitigations
- verification suggestions
- remaining unknowns
Coordination
After review:
- hand off to the repo's coding workflow for code changes
- use
ship-readinesswhen security findings affect release decisions - use
docs-writerif operational guidance or migration notes are needed
Invocation Examples
- "Use security-review on this auth change before we merge it."
- "Use security-review for this file-upload flow and list the main risks."
- "Use security-review to check this endpoint for trust-boundary mistakes."