security

Identify security vulnerabilities in code during reviews and audits.

Updated Mar 23, 2026

Search Tags:#security #review #vulnerabilities #threat-modeling #code-review #secrets-handling

Ready to run

npx skills add https://github.com/mattphanm/Codex-Agentic --skill security-mattphanm

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security
Source: https://github.com/mattphanm/Codex-Agentic/tree/main/.codex/skills/security
Command: npx skills add https://github.com/mattphanm/Codex-Agentic --skill security-mattphanm

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security reviews are often skipped or rushed, leaving critical vulnerabilities unaddressed; this Skill provides a formal mechanism to identify, document, and remediate security gaps before merging changes.

Core Features & Use Cases

Vulnerability Identification: Detect common security weaknesses such as input validation gaps, insecure authentication/authorization, and weak secrets handling.
Guided Review Process: Provides a structured checklist and evidence gathering to support reproducible security assessments.
Risk Documentation: Produces findings with actionable recommendations that can feed into tickets and documentation.

Quick Start

Run a comprehensive security review on the latest changes to identify vulnerabilities and verify adherence to best practices.

Frequently Asked Questions about security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I identify security vulnerabilities in code before merging a pull request?▼

Security reviews catch vulnerabilities before merge by applying structured checks for input validation, injection prevention, authentication controls, and secrets handling. This formal process ensures common weaknesses are documented and remediated before deployment.

What is threat modeling and how does it help with security code reviews?▼

Threat modeling during security reviews systematically identifies potential vulnerabilities like weak authorization or insecure secrets handling. It provides a structured checklist and evidence gathering to support reproducible security assessments before merging code changes.

How do I perform a security audit on new features in my codebase?▼

Perform a security audit on new features by applying a comprehensive review checklist verifying adherence to best practices. This includes checking input validation, authentication controls, and secrets handling, then producing traceable risk documentation with actionable recommendations.

What is the best way to document security risks found during code reviews?▼

The best way to document security risks is by producing structured findings with actionable recommendations that feed directly into tickets and documentation. This ensures traceable risk reporting per internal guidelines and reproducible security assessments.

Can I run a security review on spec-group implementations and PRs?▼

Yes, you can run security reviews on spec-group implementations and PRs. The review applies comprehensive checks for input validation, injection prevention, authentication authorization controls, and secrets handling to catch vulnerabilities before merge.

Why are security reviews often skipped or rushed in the development workflow?▼

Security reviews are often skipped or rushed due to time constraints, leaving critical vulnerabilities unaddressed. Implementing a formal mechanism with a structured checklist ensures security gaps are identified, documented, and remediated before merging code changes.