| name | security-review |
| description | Perform a thorough security review of the project, starting from a randomly selected file. Use this skill when the user asks for a security review, security audit, vulnerability scan, or wants to check the codebase for security issues. Also trigger when the user mentions "check for vulnerabilities", "find security bugs", "OWASP", or any request related to assessing the security posture of the project. |
| license | MIT |
Security review
Getting started
Pick a random starting point by running the bundled script. Prefix scripts/random-file.sh with this skill's base directory, the absolute path stated when the skill loads:
bash /path/to/skill/scripts/random-file.sh
Run it from the project root: the script samples whatever directory it runs in, and scripts/ belongs to this skill rather than the project.
The random entry point is intentional: it forces exploration of parts of the codebase that might otherwise be overlooked. The idea is to run this skill multiple times over the life of a project, each time pulling one thread from a different starting point.
Read the file the script returned. From there, follow one promising path -- a single thread of connections (imports, callers, callees, data flow) that looks like it could harbor a security issue. Go deep on that one path rather than trying to survey everything.
Reporting
Report exactly one finding -- the single most significant security issue you discovered along the path. Not two, not a list, just one. If nothing concerning was found, say so -- that's a valid outcome. Resist the temptation to pad the report with minor observations or informational notes.
- Starting point: which file the review began from
- Path followed: the chain of files you traced and why you chose that direction
- Finding: severity, file and line number, description, and suggested fix
