review-security

Launches a security-review subagent to audit repository diffs for vulnerabilities.

Updated Oct 15, 2019
One-click install
npx skills add https://github.com/kkkaoru/dotfiles --skill review-security-kkkaoru
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: review-security
Source: https://github.com/kkkaoru/dotfiles/tree/main/.cursor/skills-cursor/review-security
Command: npx skills add https://github.com/kkkaoru/dotfiles --skill review-security-kkkaoru

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Manually auditing code changes for security flaws is slow and easy to skip. This Skill standardizes security review by delegating the analysis of branch or uncommitted diffs to a dedicated security-review subagent with a consistent prompt format. ## Core Features & Use Cases - Automated Diff Review: Launches a security-review subagent against branch changes or uncommitted working-tree changes without computing the diff yourself. - PR and Branch Targeting: Resolves PR links, PR numbers, or branch names, checks out the target branch, and handles stash confirmation when checkout is blocked. - Structured Findings Report: Summarizes results as a severity-sorted markdown table with Severity, Location (file:line), and Finding columns. - Use Case: Before merging a feature branch, run the review to get a compact table of security findings sorted by severity so you can triage issues before merge. ## Quick Start Ask the assistant to run /review-security on the current repository to review your branch changes for security issues.

Frequently Asked Questions about review-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security review on my code changes?

Invoke /review-security and the skill launches a security-review subagent against your repository. By default it reviews branch changes against the merge-base with the default base branch, including committed, staged, and unstaged changes.

How do I review only uncommitted changes for security issues?

Ask to review uncommitted, local working tree, or not-yet-committed changes. The skill then passes "uncommitted changes" as the Diff value instead of the default "branch changes" when launching the review subagent.

Can I review a specific pull request or branch for security?

Yes. Provide a PR link, PR number, or branch name and the skill resolves it to the target branch, checks it out locally, and only then launches the review. If checkout is blocked by local changes, it asks before stashing.

When should I specify a base branch for the security review?

Only specify a base branch when your current branch should be compared against something other than the repository's default base branch, such as when the branch was created from another feature branch. Otherwise the subagent infers the base automatically.

What happens if the security review subagent fails?

The skill inspects the failure, corrects invocation mistakes and retries once, or retries once with the same prompt for other failures. If the failure persists, it stops and reports the error instead of looping.

Does the security review fix the vulnerabilities it finds?

No. The skill only reports findings in a severity-sorted table with file and line locations. It does not fix findings or rerun the review unless you explicitly ask for that next step.