| name | security-review |
| description | Perform a thorough security review of the project, starting from a randomly selected file. Use this skill when the user asks for a security review, security audit, vulnerability scan, or wants to check the codebase for security issues. Also trigger when the user mentions "check for vulnerabilities", "find security bugs", "OWASP", or any request related to assessing the security posture of the project. |
| license | MIT |
Security review
Getting started
Pick a random starting point by running the bundled script:
bash scripts/random-file.sh
The scripts/ directory is part of this skill, not the project repository.
The random entry point is intentional: it forces exploration of parts of the codebase that might otherwise be overlooked. The idea is to run this skill multiple times over the life of a project, each time pulling one thread from a different starting point.
Read the file the script returned. From there, follow one promising path -- a single thread of connections (imports, callers, callees, data flow) that looks like it could harbor a security issue. Go deep on that one path rather than trying to survey everything.
Reporting
Report exactly one finding -- the single most significant security issue you discovered along the path. Not two, not a list, just one. If nothing concerning was found, say so -- that's a valid outcome. Resist the temptation to pad the report with minor observations or informational notes.
- Starting point: which file the review began from
- Path followed: the chain of files you traced and why you chose that direction
- Finding: severity, file and line number, description, and suggested fix
