Review code and agent configuration diffs for security vulnerabilities.
npx skills add https://github.com/t0lab/harness-kit --skill security-review-t0lab
Please help me install this Agent Skill. Skill: security-review Source: https://github.com/t0lab/harness-kit/tree/main/.agents/skills/security-review Command: npx skills add https://github.com/t0lab/harness-kit --skill security-review-t0lab
Focused security reviews are frequently overlooked during general code review, leaving risky changes in authentication, authorization, secrets handling, shell execution, file/network boundaries, and agent configuration unexamined. This Skill narrows the scope to attacker-focused analysis so reviewers can determine whether a change enables access, code execution, data leakage, or unsafe agent behavior.
Review the diff for attacker-controlled inputs, trace each to its sinks, and produce exploitability-classified findings with locations, exploit paths, and recommended fixes.
High-intent search queries and answers about installing and using this skill.
Perform a focused security review by applying a risk-driven checklist to the diff, tracing attacker-controlled inputs to dangerous sinks, and producing exploitability-classified findings with remediation steps for developer triage.
Threat modeling for code changes is an attacker-focused analysis of diffs touching auth, secrets, or command execution. You need it before merging PRs that handle PII, payments, webhooks, or agent hooks to prevent security regressions.
Trace attacker-controlled inputs to dangerous sinks by reviewing the diff for required validations and authorization checks, ensuring every data-flow path is examined for injection, file, and network boundary risks.
Yes, this security review works for agent hooks and MCP configuration changes, applying a risk-driven checklist to identify access control gaps, data leakage, and unsafe agent behavior before merge approval.
Classify vulnerability exploitability by producing concrete findings that detail severity, precise location in the diff, attacker input vectors, the full exploit path, and actionable remediation guidance for developer triage.
The best way to prevent security regressions is running an attacker-focused diff review on changes to secrets handling and shell execution, verifying that all inputs are validated and proper authorization checks are enforced.
Andreicr1Trace untrusted input in web service code diffs to identify exploitable vulnerabilities.
deerawanReview phase-changed source files for bugs, vulnerabilities, and quality issues.
hcrossIdentify security risks in code changes via threat modeling, secret checks, and dependency audits.
pellepimAutomate security review and OWASP Top 10 vulnerability assessment for Node.js applications.