security-review

Identify and report security weaknesses in code changes with severity-ranked findings.

73|7|Updated May 26, 2026

Search Tags:#code review #pull request #secret management #threat modeling #security review #dependency risk

Ready to run

npx skills add https://github.com/franklioxygen/agent-workflows --skill security-review-franklioxygen

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/franklioxygen/agent-workflows/tree/main/zh-cn/skills/security-review
Command: npx skills add https://github.com/franklioxygen/agent-workflows --skill security-review-franklioxygen

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps you perform focused security review of code changes so you can catch authentication, authorization, input validation, injection, secret handling, sensitive data exposure, dependency risks, unsafe transport, and dangerous operational behavior before deployment.

Core Features & Use Cases

Diff/PR Security Assessment: Review a Pull Request, branch, or workspace diff with a security lens rather than pure correctness review.
Signal-Driven Triage: Run an automated signal scan when repository paths or changed paths are available, then investigate the highest-risk chains.
Structured Findings Reporting: Produce severity-ranked findings with actionable fixes, including concrete attack or failure scenarios.

Quick Start

Run a focused security review by scanning the repository or target file, then report any findings ordered by severity using the required output format.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I review a pull request for security vulnerabilities?▼

Reviewing a pull request for security vulnerabilities involves executing a signal scan on changed paths, cross-checking against a security checklist, and reporting severity-labeled findings with locations and mitigations.

What is threat-oriented code review and when do I need it?▼

Threat-oriented code review is the process of validating security assumptions and identifying risks like secret exposure and dependency vulnerabilities before approving changes, needed before deploying modified workspace diffs.

How do I scan my repository diff for hardcoded secrets and sensitive data exposure?▼

Scanning your repository diff for secrets requires running a local signal scan on the target file changes to detect sensitive data exposure, cross-checking findings against security rules, and applying recommended mitigations.

Can I assess dependency and transport risks in a branch diff?▼

Yes, you can assess dependency and transport risks in a branch diff by running a targeted signal scan across the repository paths, evaluating unsafe transport behavior, and generating severity-ranked findings.

What is the best way to report security findings in a code review?▼

The best way to report security findings in a code review is to produce severity-labeled results that include specific locations, concrete attack scenarios, and actionable recommended mitigations for each identified weakness.

Does automated security review cover dangerous operational actions in file changes?▼

Yes, automated security review covers dangerous operational actions in file changes by investigating high-risk chains within the workspace diff and validating operational behavior against a structured security checklist.