# Sd0xdev Sd0x Dev Flow Security Review

> Security Review Skill

- Skill: `tomevault-io/sd0xdev-sd0x-dev-flow-security-review` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/sd0xdev-sd0x-dev-flow-security-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/sd0xdev-sd0x-dev-flow-security-review/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/sd0xdev-sd0x-dev-flow-security-review

---


# Security Review Skill

## Trigger

- Keywords: security review, OWASP, vulnerability, dep-audit, npm audit, dependency security

## When NOT to Use

- General code review (use `codex-code-review`)
- Functional testing (use `test-review`)
- Performance issues (not security-related)

## Commands

| Command           | Purpose                  | When                    |
| ----------------- | ------------------------ | ----------------------- |
| `/codex-security` | OWASP Top 10 audit       | Security-sensitive code |
| `/dep-audit`      | Dependency security audit | Periodic / PR          |

## Workflow: `/codex-security`

```
Determine scope → Collect changes → Codex OWASP review → Findings + Gate → Loop if Must fix
```

### Step 1: Determine Scope

Parse `--scope` from arguments, default to `src/`.

### Step 2: Collect Code Changes

Priority order:
1. Uncommitted changes: `git diff HEAD -- <scope> | head -1500`
2. Recent commits: `git diff HEAD~5..HEAD -- <scope> | head -1500`
3. Key security files: `Glob("**/*{auth,login,password,token,secret,key,credential}*")`

### Step 3: Codex Security Review

**First review**: `mcp__codex__codex` with OWASP prompt. See `references/codex-prompt-security.md`.

Config: `sandbox: 'read-only'`, `approval-policy: 'never'`

**Save the returned `threadId`.**

**Loop review**: `mcp__codex__codex-reply` with re-review template. See `references/codex-prompt-security.md`.

### Step 4: Consolidate Output

Organize results into findings summary table + detailed findings + gate.

## OWASP Top 10

| Code | Category           | Check Focus                          |
| ---- | ------------------ | ------------------------------------ |
| A01  | Broken Access Ctrl | IDOR, permission bypass, CORS        |
| A02  | Crypto Failures    | Sensitive data encryption, weak crypto |
| A03  | Injection          | SQL/NoSQL/Cmd Injection              |
| A04  | Insecure Design    | Rate Limiting, business logic        |
| A05  | Misconfiguration   | Debug mode, default passwords        |
| A06  | Vulnerable Comp    | Known vulnerable dependencies        |
| A07  | Auth Failures      | Brute force, session, weak passwords |
| A08  | Integrity Failures | Deserialization, CI/CD               |
| A09  | Logging Failures   | Sensitive data in logs, auditing     |
| A10  | SSRF               | URL validation, internal network access |

## Review Loop

**⚠️ @CLAUDE.md auto-loop: fix → re-review → ... → ✅ PASS ⚠️**

⛔ Must fix → fix P0 issues → `/codex-security --continue <threadId>` → repeat until ✅ Mergeable.

Max 3 rounds. Still failing → report blocker.

## Verification

- [ ] Each issue tagged with severity (P0/P1/P2)
- [ ] Gate is explicit (✅ Mergeable / ⛔ Must fix)
- [ ] Fix recommendations are specific and actionable
- [ ] Includes verification test method
- [ ] Codex independently researched auth/input/sensitive code

## References

- OWASP prompt: `references/codex-prompt-security.md`
- Examples: `references/examples.md`
- Standards: @rules/security.md

## Examples

```
Input: /codex-security --scope src/controller/
Action: OWASP Top 10 check → output issues + Gate

Input: /dep-audit --level high
Action: npm audit → filter high/critical → output report
```

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/sd0xdev) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-11 -->