# Security Review

> Проверь безопасность Antigravity CLI adapter: hooks, MCP, secrets, auth. EN: security review.

- Skill: `rldyourmnd/security-review` (Agent Skill)
- Install (CLI): `npx skillmds@latest add rldyourmnd/security-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/rldyourmnd/security-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML, Security
- Author: rldyourmnd (https://skillmd.com/u/rldyourmnd)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/rldyourmnd/security-review

---


# Purpose

Find safety, secrets, auth, hook, MCP, and release risks before they ship.

# Native Antigravity Boundary

Antigravity committed settings use the `auto_edit` approval mode, the maximal
committable owner-autonomy posture currently proven for this adapter. Do not
copy retired legacy runtime `--approval-mode=yolo` semantics into active
Antigravity runtime docs or launchers.

# When To Use

Use for hook changes, MCP changes, workflow changes, auth docs, release scripts,
and security-sensitive config.

# Inputs

Git diff, config files, hooks, workflows, and policy files.

# Procedure

1. Inspect high-risk shell/git/file operations.
2. Check secrets and token handling.
3. Verify MCP env boundaries.
4. Check workflow permissions and action pins.
5. Report findings before summaries.

# Evidence Required

File/line references, risk impact, and remediation.

# Forbidden Actions

Do not expose secrets or normalize unsafe auto-approval in committed config.

# Acceptance Checks

Security review plus relevant validators and tests.

# Failure Reporting

Order findings by severity and include exact fix guidance.