Security review
Skill yarlson/yarstack/plugins/yarstack/skills/security-review
Engineering workflows and standards for Codex and Claude Code: plan, implement, test, review, and deliver repository changes.
npx -y skills add yarlson/yarstack --skill security-reviewAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 3 stars3 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Review a focused trust-boundary or exploit-path change without modifying it. Use when work introduces or materially changes untrusted input, privilege decisions, secret flow, dangerous sinks, or agent and tool capabilities.
SKILL.md
1.6 KB, as published. Nobody here has run it
Security Review
Own concrete trust-boundary and exploit-path analysis, not generic changed-code review.
Workflow
- Confirm the diff or audit scope, assets, actors, trust boundaries, and relevant privileges.
- Trace each material untrusted source through parsing, validation, authorization, and dangerous sinks or persistent side effects.
- Check changed secret handling, command execution, paths and archives, network destinations, authentication, authorization, tenant isolation, logs, plugins, MCP tools, sandboxes, and agent capabilities only where they participate in a concrete path.
- Separate confirmed exploit paths from defense-in-depth observations and unresolved evidence gaps.
- Delegate dependency provenance to
dependency-review, IaC blast radius toinfra-review, platform lifecycle to its specialist, and operational recovery torollout-readiness-review.
For each finding report severity, affected location and behavior, attacker prerequisites, exploit path, impact, smallest safe correction, verification, and uncertainty. State directly when no confirmed finding exists.
Keep the review read-only. Do not rotate credentials, modify live services, run unsafe payloads, add security frameworks, or broaden scope. Remediation requires separate implementation authority.
Finish when material trust paths in scope are traced and findings or confidence limits are explicit.