security-review

Inspect code changes for security vulnerabilities in unsafe APIs and memory handling.

9|1|Updated Jun 6, 2025
One-click install
npx skills add https://github.com/JeremyKuhne/touki --skill security-review-jeremykuhne
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: security-review
Source: https://github.com/JeremyKuhne/touki/tree/main/.agents/skills/security-review
Command: npx skills add https://github.com/JeremyKuhne/touki --skill security-review-jeremykuhne

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Identifies and pins down security-related risks in code changes, preventing unsafe patterns and memory safety issues from entering production.

Core Features & Use Cases

  • Comprehensive checklists for unsafe APIs, memory handling, input validation, and DoS-resistant design.
  • Guidance for creating safe-property tests and regression tests that pin safe behavior without locking in incorrect outputs.
  • Use Case: Before publishing a PR that touches parser logic or memory handling, run this security review to surface potential vulnerabilities and recommended mitigations.

Quick Start

Review the latest PR for security vulnerabilities using the core guidelines to surface unsafe patterns and suggested mitigations.

Frequently Asked Questions about security-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I identify security vulnerabilities in code changes before merging a PR?

You identify security vulnerabilities by running a structured review on PRs and commits that touch unsafe APIs, memory handling, or parsing logic to surface potential risks and recommended mitigations.

What is a structured security review for memory safety and unsafe APIs?

A structured security review for memory safety is an audit applying comprehensive checklists for unsafe APIs, memory handling, input validation, and DoS-resistant design to prevent unsafe patterns from entering production.

How do I create safe-property tests that pin safe behavior without locking in incorrect outputs?

You create safe-property tests by following security review guidance to pin safe behavior and validate preconditions without locking in incorrect outputs, ensuring regression tests focus on security boundaries.

Does this security code review work for commits that touch parsing logic and input validation?

Yes, this security code review works for commits touching parsing logic by applying a structured audit that checks input validation, DoS-resistant design, failure modes, and required tests to surface unsafe patterns.

What's the best way to review unsafe APIs for potential security risks and DoS-resistant design?

The best way to review unsafe APIs for security risks is using a structured checklist approach that validates preconditions, failure modes, input validation, and DoS-resistant design before publishing a PR.

Why do I need a structured review for unsafe memory handling instead of a standard code review?

You need a structured review for unsafe memory handling because standard reviews often miss specific security vulnerabilities, whereas a structured audit enforces checks for preconditions, failure modes, and required regression tests.