security-review

Assess security boundary crossings in code changes across LLM API, persistence, and system execution layers.

2|Updated May 13, 2026
One-click install
npx skills add https://github.com/alexherrero/crickets --skill security-review-alexherrero
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/alexherrero/crickets/tree/main/src/code-review/skills/security-review
Command: npx skills add https://github.com/alexherrero/crickets --skill security-review-alexherrero

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Structured security review enables teams to identify and remediate boundary-crossing risks in code changes by focusing on trust boundaries: LLM API, persistence, and system execution.

Core Features & Use Cases

  • Boundary-aware threat modeling that maps each diff to its risk boundary and guides tiered analysis in order.
  • Stepwise evaluation across Tier 1 (LLM API), Tier 2 (persistence), and Tier 3 (system execution) with clear remediation guidance.
  • Use Case: Before merging code that handles prompts, writes to disk, or executes shell commands, reliably surface vulnerabilities and generate a prioritized fix plan.

Quick Start

Validate a recent diff with a security-review to surface boundary-crossing risks and generate a structured report

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a security review on code that handles LLM prompts and shell execution?

A security review for LLM prompts and shell execution maps code diffs to trust boundaries across LLM API, persistence, and system execution layers. It guides tiered analysis to surface vulnerabilities and generate a prioritized fix plan.

What is boundary-aware threat modeling in code changes?

Boundary-aware threat modeling identifies security risks by mapping each code diff to its specific trust boundary. It evaluates crossings across LLM API, persistence, and system execution tiers to isolate vulnerabilities during code reviews.

How do I detect prompt injection risks before merging LLM API code?

Detect prompt injection risks by applying a tiered security review to code diffs handling LLM API boundaries. The review maps changes to trust boundaries and provides structured findings with clear remediation guidance before merging.

Does this security review work for code that writes to disk and invokes subprocesses?

Yes, this security review works for code writing to disk and invoking subprocesses by evaluating Tier 2 persistence and Tier 3 system execution boundaries. It assesses file persistence and subprocess invocations to surface boundary-crossing risks.

What's the best way to structure security findings for code handling external integrations?

The best way to structure security findings for external integrations is using a mapped diff workflow with tiered analysis. It generates a standardized report with conclusive findings or a NO ISSUES FOUND status.

When do I need a tiered security analysis for my code changes?

You need a tiered security analysis for code changes when handling LLM prompts, model outputs, file persistence, or subprocess invocations. It maps diffs to risk boundaries and guides stepwise evaluation across LLM API, persistence, and system execution layers.