Code Security Review Pipeline
curated by SkillMD · plugin · 15 skills
Audit code changes for bugs, security flaws, and quality issues before merging.
Install the whole plugin (CLI)
npx skillmds add antigravity/find-bugs
npx skillmds add antigravity/logic-lens
npx skillmds add antigravity/fix-review
npx skillmds add addyosmani/security-and-hardening
npx skillmds add antigravity/cred-omega
npx skillmds add cloudflare-security-audit/security-audit
npx skillmds add juliusbrussee/caveman-review
npx skillmds add antigravity/brooks-lint
npx skillmds add deep-chavda/ai-engineering-standards
npx skillmds add zhaoxuya520/reverse-skill-router
npx skillmds add zhaoxuya520/code-audit
npx skillmds add zhaoxuya520/apk-reverse
npx skillmds add zhaoxuya520/api-security
npx skillmds add zhaoxuya520/dotnet-reverse
npx skillmds add zhaoxuya520/reverse-engineeringSkills in this plugin
- ▌ find-bugs · antigravityReview local branch changes for bugs, security vulnerabilities, and code quality issues using a structured checklist-driven process.
- ▌ logic-lens · antigravityAnalyzes code for logical errors, race conditions, security vulnerabilities, and algorithmic flaws using structured reasoning across 9 risk categories.
- ▌ fix-review · antigravityVerifies that fix commits properly address security audit findings without introducing new bugs or vulnerabilities.
- ▌ security-and-hardening · addyosmaniHardens code against vulnerabilities by applying threat modeling, OWASP Top 10 prevention patterns, and secure coding practices for web applications.
- ▌ cred-omega · antigravityDiscovers, classifies, protects, and governs API keys, tokens, secrets, and credentials across all providers with enterprise-grade security auditing and governance.
- ▌ security-audit · cloudflare-security-audit bundleFinds exploitable vulnerabilities in codebases through a structured multi-phase audit covering recon, hunting, validation, and reporting.
- ▌ caveman-review · juliusbrussee bundleProduces ultra-compressed, one-line code review comments that cut noise while preserving actionable signal. Each comment includes location, problem, and fix.
- ▌ brooks-lint · antigravityReviews code through the lens of 12 classic software engineering books, catching design smells, coupling issues, and architectural risks that linters miss.
- ▌ ai-engineering-standards · deep-chavdaEnforces production-grade Python and AI engineering standards for FastAPI, LangChain/LangGraph, RAG pipelines, and LLM integrations, covering type safety, error handling, testing, and security.
- ▌ reverse-skill-router · zhaoxuya520 bundleRoutes reverse engineering, exploitation, penetration testing, malware, mobile, firmware, browser automation, documentation, and security tasks to the appropriate specialist skill. Use when a task spans modules or the correct reverse-skill entrypoint is unclear.
- ▌ code-audit · zhaoxuya520 bundlePerforms authorized source-code security reviews using SAST tools like Semgrep and CodeQL, with manual verification of findings and fix recommendations.
- ▌ apk-reverse · zhaoxuya520 bundleProvides a structured CLI workflow for Android APK reverse engineering, covering decompilation with jadx and apktool, smali modification, repackaging, signing, and Frida dynamic hooking, with optional native .so analysis via IDA or radare2.
- ▌ api-security · zhaoxuya520 bundleAuthorized security assessment of REST, GraphQL, WebSocket, and SOAP APIs covering discovery, authentication, authorization, rate-limiting, and CI/CD integration.
- ▌ dotnet-reverse · zhaoxuya520 bundleProvides a structured workflow for reverse engineering .NET and C# binaries, including deobfuscation with de4dot, static analysis via dnSpyEx IL view, dynamic debugging, and reliable IL patching for red-team tools and malware.
- ▌ reverse-engineering · zhaoxuya520 bundleProvides structured reverse engineering techniques for analyzing compiled, obfuscated, packed, or virtualized targets including binaries, APKs, WASM, firmware, and custom VMs using static and dynamic analysis workflows.