Security review
Reusable, token-optimized agent skills for autonomous development with Hermes, Claude Code & OpenCode. Multi-model orchestration patterns — context-checkpointing, human review gates, RLS security, GDPR consent, AI cost control, and test-fix loops. Framework-agnostic, agentskills.io compatible.
npx -y skills add prasadmogulothu/agent-skills --skill security-reviewAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Run a read-only security audit of sensitive code (auth, data isolation, secret handling, payments, input validation) before merging or deploying. Ships with a reviewer-agent definition. Block on critical/high findings.
SKILL.md
2.3 KB, as published. Nobody here has run it
security-review
A bounded, read-only audit you run before shipping anything sensitive. Pair it with the
security-reviewer.md agent definition in this folder (pin it to a frontier model).
What it audits
- Data isolation — per-user/tenant rows are protected (e.g. row-level security); a user cannot read or write another user's data. Confirm an isolation test exists and passes.
- Secret handling — no API keys, service keys, or tokens in client bundles, logs, or git.
- Auth — sessions expire; no privilege escalation; OAuth/MFA configured where claimed.
- Payments (if any) — entitlement is verified server-side; webhooks verified; no way to unlock paid features without paying.
- LLM endpoints (if any) — keys server-side; inputs validated; prompt-injection considered for any user free-text passed to a model.
- Input validation & headers — schema validation on inputs; security headers (CSP, HSTS).
Output format
For each finding: Severity (CRITICAL|HIGH|MEDIUM|LOW) | file:line | issue | concrete fix.
End with VERDICT: PASS (no critical/high open) or VERDICT: BLOCK (list blockers).
Block on any CRITICAL or HIGH.
Token tactics
Read-only (no edits) = bounded cost. Run once per convergence/PR, not per commit. Review only the diff/paths given, never crawl the whole repo.
Bundled agent: security-reviewer
Copy the following into your agent's sub-agent folder (e.g. .claude/agents/security-reviewer.md)
and pin it to a frontier model:
---
name: security-reviewer
description: Read-only security audit of critical code before merge/deploy.
model: <frontier-model>
tools: [Read, Bash]
---
You are a senior application security engineer. You audit; you do not edit. Be specific and cite
file:line. Audit: data isolation, secret handling, auth, payments, LLM endpoints, input
validation, and security headers (see the security-review skill). For each finding output
`Severity | file:line | issue | fix`. End with `VERDICT: PASS` or `VERDICT: BLOCK`. Block on any
CRITICAL or HIGH. Review only the paths given; do not crawl the repo.