How do I install the Security Review skill?

Run npx skillmds@latest add karthick-ramachandran/security-review in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Security Review safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: executes scripts. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Security Review?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Security Review free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Security Review?

Karthick-Ramachandran (@karthick-ramachandran) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Security Review by karthick-ramachandran

Name: Security Review
Rating: 4.666666666666667 (3 reviews)
Author: Karthick-Ramachandran

Security Review

Review a change for security risks before it is accepted. Use when a change touches a trust boundary — file writes, paths, dependencies, stored secrets, network calls, telemetry, MCP, auth — and needs a decision before merging. Skip for feature planning, test writing, and convention checks.

File contents

Goal

Find security risks in a change before it is accepted.

Inputs

The change as a diff or summary.
Test results, when they exist.

Workflow

Identify changed trust boundaries: file writes, paths, dependencies, auth, stored secrets, network calls, telemetry, MCP.
Run scripts/scan-secrets.sh over the staged diff and treat matches as blockers until cleared. If scripts/ is unavailable (deleted or cannot execute), perform the same scan by reading the diff directly.
Check path validation, overwrite policy, and symlink handling.
Check dependency, template, and configuration risk.
Check that tests cover the security-sensitive behavior.
Classify findings as blockers, risks, or documented tradeoffs.
Hand back the verdict with the finding list.

Decisions

If a credential is present in the change → blocker; stop and ask for its removal.
If writes can escape the repository root → blocker.
If the change conflicts with accepted repository memory → stop and ask for a human decision.

Verification

Every trust boundary the change touches has a finding or an explicit all-clear.
Blockers name the exact file and line.
No finding is generic filler.

Resources

For the security model → docs/20-security/SECURITY_MODEL.md
For threat context → docs/20-security/THREAT_MODEL.md (when present)

Output

Verdict: accept, accept with risks, or block.
Finding list with files, lines, and severity.

Frequently asked questions