Run any Skill in Manus with one click

security-code-review

Stars1

Forks0

UpdatedMay 30, 2026 at 20:38

Review a git diff for vulnerabilities by running Semgrep and CodeQL, then emit structured findings. Use when the user asks for a security review of a diff/PR.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

theagenticguy

theagenticguy/agentic-security-lab

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

name	security-code-review
description	Review a git diff for vulnerabilities by running Semgrep and CodeQL, then emit structured findings. Use when the user asks for a security review of a diff/PR.
allowed-tools	Bash(semgrep ) Bash(codeql ) Bash(git diff *) Read Grep
disable-model-invocation	true
context	fork
agent	general-purpose

Diff under review

!git diff --merge-base origin/main

Task

Run semgrep --config auto --sarif -o /tmp/semgrep.sarif $(git diff --name-only --merge-base origin/main).
If a CodeQL DB exists at .codeql/db, run codeql database analyze .codeql/db --format sarifv2.1.0 -o /tmp/codeql.sarif <suite>.
Merge SARIF; keep only findings on changed lines.
Emit one block per finding: file:line, CWE, severity (CRITICAL/HIGH/MED/LOW), evidence snippet, fix. End with a markdown summary table and a PASS/FAIL gate (FAIL if any CRITICAL/HIGH). Do not modify source files. Report only.

More from this repository

same repository

variant-analysis

theagenticguy/agentic-security-lab

Big-Sleep variant analysis. Given a recently-fixed bug shape (the lines added/removed in a patch), find more code in the repository that has the same shape and is likely to carry the same defect. Reports variants linked to their seed. Deny-by-default: only the allowed_tools below are permitted.

2026-06-011

security-code-review

theagenticguy/agentic-security-lab

Review a code diff or corpus for security vulnerabilities grounded in the supplied threat model. Reads code semantically, forms hypotheses, verifies them, and emits scored findings as a single JSON code block. Deny-by-default: only the allowed_tools below are permitted.

2026-06-011

threat-model-bootstrap

theagenticguy/agentic-security-lab

Given an architecture description or diagram, produce a STRIDE threat model plus attack trees as YAML. Use when the user asks to threat model a system.

2026-05-311

reachability-triage

theagenticguy/agentic-security-lab

Triage a candidate finding by deciding whether the vulnerable code is reachable from an untrusted entry point, producing the reachability axis (0-1) that feeds asec-confidence. Use when the user asks to triage a finding or assess exploitability.

2026-05-301

threat-model-bootstrap

theagenticguy/agentic-security-lab

Given an architecture description, diagram, or repo, produce a Phase-Zero STRIDE threat model plus attack trees as YAML conforming to asec-threat-model schema. Use when the user asks to bootstrap or create a threat model for a system.

2026-05-301

threat-model-critic

theagenticguy/agentic-security-lab

Critique an existing threat model for completeness and rigor — missing STRIDE categories, unjustified skips, weak mitigations, ungrounded likelihood/impact. Use when the user asks to review, critique, or red-team a threat-model.yaml.

2026-05-301

Run any Skill with one click