agent-security-review

Review PR diffs for vulnerabilities, secrets, and misconfigurations.

8|13|Updated Apr 13, 2026

Search Tags:#security #dependencies #code-review #auth #pull-request #secrets-detection

Ready to run

npx skills add https://github.com/queen-of-code/AI-DLC --skill agent-security-review

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: agent-security-review
Source: https://github.com/queen-of-code/AI-DLC/tree/main/plugins/ai-dlc-skills/skills/agents/agent-security-review
Command: npx skills add https://github.com/queen-of-code/AI-DLC --skill agent-security-review

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Provides a lightweight, focused security review for a single pull request or change set to find obvious vulnerabilities, leaked secrets, misconfigurations, and authorization gaps that should be flagged before advanced security review or deployment.

Core Features & Use Cases

Secrets & credentials detection: Identify committed keys, tokens, PEM files, and insecure environment variable patterns.
Auth & access checks: Highlight missing authorization checks, IDOR risks, and deviations from the approved tech spec.
Dependencies and config hygiene: Call out risky dependency changes, unpinned base images, and debug/default credentials in configs.
Use Case: Run this as a review-phase pass to generate blocking vs advisory findings and feed results to the /review orchestrator for PR comments and a review-report.md entry.

Quick Start

Run a security review on this PR and produce blocking or advisory findings with file references for the /review orchestrator.

Frequently Asked Questions about agent-security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I check a pull request for leaked secrets and security vulnerabilities?▼

To check a pull request for leaked secrets, run a lightweight security review on the PR diffs to identify committed keys, tokens, PEM files, and insecure environment variable patterns. It outputs blocking or advisory findings with specific file references.

What is the best way to detect IDOR risks and missing authorization checks in a code change?▼

The best way to detect IDOR risks is to apply a security review against the approved tech spec authorization model and PR diffs. It highlights missing authorization checks and deviations from the spec before deployment.

Can I review container manifests and dependencies for misconfigurations in a PR?▼

Yes, you can review container manifests and dependencies for misconfigurations in a PR. The security review checks touched files across backend services and web frontends to call out risky dependency changes and unpinned base images.

What inputs do I need to perform a security review on a pull request?▼

To perform a security review on a pull request, you need to provide the PR diffs, touched files, the approved tech spec authorization model, and repository stack context to generate accurate blocking or advisory findings.

Does a lightweight PR security review replace advanced security scanning?▼

A lightweight PR security review does not replace advanced security scanning. It focuses on catching obvious vulnerabilities, misconfigurations, and authorization gaps that should be flagged before an advanced security review or deployment.

How do I format security review findings for a pull request comment?▼

To format security review findings for a pull request comment, generate blocking or advisory findings with direct file references. These results can then be fed to the review orchestrator to populate PR comments and a review-report entry.