review-security

Name: review-security
Author: gtrabanco

32installs2forks

How to install review-security?

gtrabanco/agentic-workflow/review-security

$npx -y skills add gtrabanco/agentic-workflow --skill review-security

Installs into the current project.

Summary

Internal security review pass of the agentic-workflow review pack — composed in-turn by review-change and product-audit; not a menu entry. Checks secrets, input validation, injection, authn/authz, PII exposure, and dependency risk on the changed surface. Findings only; never edit

Files · 1

View on GitHub

SKILL.md

1	# Review Security (internal)
2
3	Composed by `review-change` / `product-audit` within their conversation — on any
4	agent, follow this file inline as the routed step. **Findings only; never edits,
5	never refactors.**
6
7	## Scope
8
9	The diff or path/glob the caller passes; default the current change vs the
10	default branch. State the scope at the top of the returned table.
11
12	## Checklist (evaluate EVERY item — none is optional; n/a must be stated)
13
14	✓ No secrets/credentials/tokens in code, config, tests, or fixtures (grep the
15	diff for key-like strings)
16	✓ Every external input on the changed paths is validated/sanitized before use
17	✓ No injection vectors (SQL/command/path/template) — parameterized/escaped,
18	never concatenated
19	✓ AuthN/AuthZ enforced on every new/changed endpoint or entry point (cite
20	where)
21	✓ No PII or secrets written to logs/error messages on the changed paths
22	✓ Webhooks/callbacks verify signatures before processing
23	✓ Rate limiting / abuse controls considered where a new public surface appears
24	(n/a if none)
25	✓ New/updated dependencies pinned and free of known-critical advisories (state
26	how you checked)
27	✓ Error responses don't leak stack traces or internal paths
28	✓ Unsafe deserialization / dynamic evaluation of untrusted data absent
29
30	## Return exactly
31
32	```
33	REVIEW SECURITY — scope: <scope>
34
35	\| # \| Finding \| Sev \| Evidence \| Suggested fix \|
36	\|---\|---------\|-----\|----------\|---------------\|
37	\| 1 \| <what> \| critical\|major\|minor \| <file:line> \| <smallest action> \|
38
39	Checklist: <n> evaluated, <n> pass, <n> findings, <n> n/a (<which + why>)
40	Summary: <1-2 sentences>
41	Decision: PASS \| FAIL
42	```
43
44	FAIL if any critical or major finding is open; PASS otherwise. Minor findings
45	never block — they route to the caller's triage step.
46
47	## Done when
48
49	- Every checklist item was evaluated with evidence (file:line or command output)
50	or explicitly marked n/a with the reason.
51	- The fixed-format block above is returned — nothing more, nothing less — and
52	no code was changed.

People who liked this also viewed

6 picks

Type

review-security

32installs2forks

View on GitHub

How to install review-security?

gtrabanco/agentic-workflow/review-security

$npx -y skills add gtrabanco/agentic-workflow --skill review-security

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Review Security (internal)
2
3	Composed by `review-change` / `product-audit` within their conversation — on any
4	agent, follow this file inline as the routed step. **Findings only; never edits,
5	never refactors.**
6
7	## Scope
8
9	The diff or path/glob the caller passes; default the current change vs the
10	default branch. State the scope at the top of the returned table.
11
12	## Checklist (evaluate EVERY item — none is optional; n/a must be stated)
13
14	✓ No secrets/credentials/tokens in code, config, tests, or fixtures (grep the
15	diff for key-like strings)
16	✓ Every external input on the changed paths is validated/sanitized before use
17	✓ No injection vectors (SQL/command/path/template) — parameterized/escaped,
18	never concatenated
19	✓ AuthN/AuthZ enforced on every new/changed endpoint or entry point (cite
20	where)
21	✓ No PII or secrets written to logs/error messages on the changed paths
22	✓ Webhooks/callbacks verify signatures before processing
23	✓ Rate limiting / abuse controls considered where a new public surface appears
24	(n/a if none)
25	✓ New/updated dependencies pinned and free of known-critical advisories (state
26	how you checked)
27	✓ Error responses don't leak stack traces or internal paths
28	✓ Unsafe deserialization / dynamic evaluation of untrusted data absent
29
30	## Return exactly
31
32	```
33	REVIEW SECURITY — scope: <scope>
34
35	\| # \| Finding \| Sev \| Evidence \| Suggested fix \|
36	\|---\|---------\|-----\|----------\|---------------\|
37	\| 1 \| <what> \| critical\|major\|minor \| <file:line> \| <smallest action> \|
38
39	Checklist: <n> evaluated, <n> pass, <n> findings, <n> n/a (<which + why>)
40	Summary: <1-2 sentences>
41	Decision: PASS \| FAIL
42	```
43
44	FAIL if any critical or major finding is open; PASS otherwise. Minor findings
45	never block — they route to the caller's triage step.
46
47	## Done when
48
49	- Every checklist item was evaluated with evidence (file:line or command output)
50	or explicitly marked n/a with the reason.
51	- The fixed-format block above is returned — nothing more, nothing less — and
52	no code was changed.

People who liked this also viewed

6 picks

Type