Run any Skill in Manus with one click

Get Started

security-review

Stars0

Forks0

UpdatedApril 21, 2026 at 09:25

Complete a security review of the pending changes on the current branch

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

shin1ohno

shin1ohno/setup

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

name	security-review
description	Complete a security review of the pending changes on the current branch
user-invocable	true
allowed-tools	["Bash","Agent","Read","Grep","Glob","AskUserQuestion"]
argument-hint	[base_commit]

Security Review Skill

Purpose

Review code changes for security vulnerabilities by diffing against a base commit and launching the code-reviewer agent (from pr-review-toolkit) with a security-focused prompt.

Argument Parsing

$ARGUMENTS is an optional base commit hash or ref. Examples:

/security-review — auto-detect base
/security-review faee240 — diff from specific commit
/security-review main — diff from branch
/security-review 今のコード全てを監査 — natural language; extract hash if present, otherwise auto-detect

Workflow

Step 1: Determine Base Commit

Try these in order until one succeeds:

Argument provided: if $ARGUMENTS looks like a commit hash (hex string) or branch name, use it directly as base
merge-base: run git merge-base HEAD origin/$(git rev-parse --abbrev-ref HEAD 2>/dev/null) 2>/dev/null
Fallback: show git log --oneline -15 and use AskUserQuestion to ask the user which commit to diff from

Step 2: Generate Diff

Run: git diff <base>..HEAD -- . ':!*.bin' ':!*.sqlite3' ':!*.pickle' ':!*.png' ':!*.jpg'

Also run git diff <base>..HEAD --stat for the summary.

If the diff is empty, inform the user and stop.

Step 3: Launch Security-Focused Code Review

Launch the code-reviewer agent (from the pr-review-toolkit plugin) with an explicit security-focus prompt. Include:

The full diff output (excluding binary files)
The diff stat summary
A security-focused review directive: "Focus on OWASP Top 10 vulnerabilities (injection, XSS, SSRF, auth/session flaws, crypto misuse, path traversal, unsafe deserialization, etc.) plus secret leakage, unsafe exec/eval, and untrusted input flowing to privileged sinks. Rate each finding by severity (Critical/High/Medium/Low/Info)."
Instructions to focus on changed lines but read surrounding context as needed

code-reviewer already supports confidence scoring (0-100) per finding; use its output format directly.

Step 4: Present Results

When the agent returns, present findings organized by severity (Critical → High → Medium → Low → Info). Include:

Total finding count by severity
Each finding with file:line, attack vector, and remediation
"No findings" sections explicitly listed

More from this repository

same repository

todo-collect

shin1ohno/setup

config（~/.claude/todo/sources.yaml + sources.local.yaml）に列挙された外部 capture ソース — Slack saved（後で見る）/ 📌 リアクション / self-DM、Google Tasks、 Apple Reminders（remind --dump）、Claude Code transcript の deferral 発話、カレンダー連携 Notion 議事録 — を sweep し、 TODO 形に正規化（完了条件の起草 + provenance 付与）して機密性 routing どおりの memory store（ai-memory / memory-local）に tags:["todo"] で書き込む毎日ループ skill。 explicit ソース（明示マーク）は自動保存 + 領収書 1 行、inferred ソース（推論抽出）は候補提案のみ（承認後に保存）。dedup は provenance キー。結果は ~/.claude/todo/ledger.md に追記。設計の真実源は ~/.claude/docs/todo-management.md。「todo collect」「TODO 集めて」「capture 集めて」「TODO 収集」でトリガー。注: ソース側の状態は絶対に変更しない（Task の完了化・saved 解除等をしない）。例外は連携ストアの Apple Reminders のみ（リンクトークン annotate と close 伝播 complete）。仕事ソースの sink は memory-local 固定 — 個人 ai-memory へ流すのは egress 違反。

2026-07-080

todo-reconcile

shin1ohno/setup

全 TODO ストア（各 repo の TODO.md、ai-memory / memory-local の tags:["todo"]、 federated な GitHub issues）を横断列挙し、項目ごとに 2 秒 probe で stale を検出して済み / 前提消滅 / 継続 / 要判断に分類する、TODO 管理パイプラインの週次棚卸しループ skill。 probe なしの即答列挙（list モード）も担当。結果は ~/.claude/todo/ledger.md に書き出す。ストア設計・capture routing は ~/.claude/docs/todo-management.md が真実源。デフォルトは dry-run（列挙 + probe + 分類提案のみ。forget も TODO.md 編集もしない）。「todo reconcile」「TODO 棚卸し」「TODO 掃除」で dry-run、「TODO 見せて」「open な TODO は」で list モード、「LIVE mode」明記で適用モード。注: forget / TODO.md 編集は機械的証拠か明示承認がある場合のみ。TODO.md 編集は PR 経由（main 直 push 禁止）。issues と TODO.md は列挙するだけで複製しない。

2026-07-060

mcp-auth

shin1ohno/setup

Check the connection and authentication status of every MCP server and re-authenticate any that need it, one at a time. Use when the SessionStart MCP health hook reports "NEEDS-AUTH" / "MCP connectors need attention", when an mcp__* tool call fails with an auth or connection error, or when the user asks to check MCP status, reconnect MCP, "MCP 認証", "check mcp", "mcp 繋がってない", "認証されていない MCP を認証して".

2026-07-060

self-heal-resolve

shin1ohno/setup

self-heal observability ループの Layer 2-B（issue 解決）。shin1ohno/setup の open な self-heal ラベル issue を 1 件選び、fleet を調査して根本原因を特定し、修正する自律ループ。 allowlist 内の remediation class（既知サービスの再収束／cookbook drift 修正）は調査→修正→PR→CI green→merge→auto-mitamae 適用→機能検証→issue close まで完全自律。 allowlist 外（新規設計・破壊的変更・auth/secret・原因不明・3 回失敗）は PR/診断を残して self-heal-needs-human を付け停止。merge は CI green 必須、破壊的操作禁止、1 回 1 issue。 owner(shin1ohno) が issue/PR に付けたコメント・更新は GO 承認として拾い、needs-human でも再着手する（第三者のコメント・更新は無視。bot コメントは  で識別）。「self-heal resolve」「self-heal issue を直す」「fleet alert を解決」でトリガー。対は self-heal-create（ES 状態を issue 化する loop）。

2026-07-060

bootstrap-docs-hub

shin1ohno/setup

Scaffold a new documentation-hub repository for a project: README.md, CLAUDE.md (AI agent instructions), .claude/rules/ discipline files, bundled skills/agents (interview, retro, writing, notion-cli, claude-docs-researcher, session-retrospective, sync-bundled-tools), .gitignore, and an initial git commit. Use when user asks to "set up a docs hub", "create a documentation repository", "新しいプロジェクトのドキュメントハブを作る", "ドキュメント管理リポジトリを scaffold", "init docs project", or starts a fresh repo intended to manage external doc links (Notion, Slack, etc.) rather than source code.

2026-07-060

load-test

shin1ohno/setup

Progressive load testing and performance tuning for Docker services. Identifies hard constraints, finds breaking points, and proposes tuning within safe limits.

2026-07-060

name	security-review
description	Complete a security review of the pending changes on the current branch
user-invocable	true
allowed-tools	["Bash","Agent","Read","Grep","Glob","AskUserQuestion"]
argument-hint	[base_commit]

Security Review Skill

Purpose

Review code changes for security vulnerabilities by diffing against a base commit and launching the code-reviewer agent (from pr-review-toolkit) with a security-focused prompt.

Argument Parsing

$ARGUMENTS is an optional base commit hash or ref. Examples:

/security-review — auto-detect base
/security-review faee240 — diff from specific commit
/security-review main — diff from branch
/security-review 今のコード全てを監査 — natural language; extract hash if present, otherwise auto-detect

Workflow

Step 1: Determine Base Commit

Try these in order until one succeeds:

Argument provided: if $ARGUMENTS looks like a commit hash (hex string) or branch name, use it directly as base
merge-base: run git merge-base HEAD origin/$(git rev-parse --abbrev-ref HEAD 2>/dev/null) 2>/dev/null
Fallback: show git log --oneline -15 and use AskUserQuestion to ask the user which commit to diff from

Step 2: Generate Diff

Run: git diff <base>..HEAD -- . ':!*.bin' ':!*.sqlite3' ':!*.pickle' ':!*.png' ':!*.jpg'

Also run git diff <base>..HEAD --stat for the summary.

If the diff is empty, inform the user and stop.

Step 3: Launch Security-Focused Code Review

Launch the code-reviewer agent (from the pr-review-toolkit plugin) with an explicit security-focus prompt. Include:

The full diff output (excluding binary files)
The diff stat summary
A security-focused review directive: "Focus on OWASP Top 10 vulnerabilities (injection, XSS, SSRF, auth/session flaws, crypto misuse, path traversal, unsafe deserialization, etc.) plus secret leakage, unsafe exec/eval, and untrusted input flowing to privileged sinks. Rate each finding by severity (Critical/High/Medium/Low/Info)."
Instructions to focus on changed lines but read surrounding context as needed

code-reviewer already supports confidence scoring (0-100) per finding; use its output format directly.

Step 4: Present Results

When the agent returns, present findings organized by severity (Critical → High → Medium → Low → Info). Include:

Total finding count by severity
Each finding with file:line, attack vector, and remediation
"No findings" sections explicitly listed