Menu
Run only the security and threat-model lens from the improve workflow on a target file, directory, or glob, producing read-only adversarial findings.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Review-first aggressive code simplification for a target file, directory, or glob, producing numbered findings and applying only user-selected changes.
Ask the other coding agent (Claude ↔ Codex) to review the relevant changes
Split a multi-finding worktree into per-finding commits via non-interactive `git add -p`. Use when an `/improve` or `/review` pass has edited several distinct findings into the worktree together and they need to land as separate commits. Refuses to run on secret-rendering templates.
Run only the first-principles analysis lens from the improve workflow on a target file, directory, or glob, producing read-only findings without applying edits.
Run only the prior-art and convention lens from the improve workflow on a target file, directory, or glob, producing read-only findings based on mature implementations and local sibling patterns.
Run only the radical-simplification lens from the improve workflow on a target file, directory, or glob, producing read-only findings about subtractive or restructuring improvements.
| name | improve-security |
| description | Run only the security and threat-model lens from the improve workflow on a target file, directory, or glob, producing read-only adversarial findings. |
Read ../improve/references/target-and-agent-contract.md first.
When called directly, resolve the target and build the context brief from the shared contract. When called by $improve, use the provided target paths, usage scenarios, target summary, test-file flag, and optional <user_note>.
Stay read-only. Return findings using the unified return contract.
Perform an adversarial read of the target.
Map trust boundaries:
For each reachable boundary, enumerate concrete threats:
Each finding must include the specific line or construct, the exploit shape in one sentence, the concrete fix, and severity. Skip theoretical risks that do not apply. If the target is a pure test file with no meaningful adversarial surface, return "not applicable" with one sentence and the biggest single win line.
Stay in this lane: adversarial threats only. Do not propose simplifications, feature additions, or style nits.
