skill CX Codex

security-review · waybarrios — Claude Code skill: review and install

Q: How do I install security-review in Claude Code?

Run `npx skills add waybarrios/opencode-power-pack --skill security-review -a claude-code`, then open `~/.claude/skills/security-review/SKILL.md`.

Checks Git changes for high-confidence vulnerabilities with a credible exploitation path. Use it before merging when a general code review is not enough.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓

npx skills add waybarrios/opencode-power-pack --skill security-review -a claude-code

Open on GitHub

What security-review does

This skill examines one frozen change set and reports only vulnerabilities introduced by that set when the exploitation case is well supported. It can review pending work on a branch, a pull request, or an explicit commit range. It is not a general code review, so style and ordinary correctness checks are outside its purpose.

The workflow resolves the review boundary, snapshots relevant worktree data, and verifies content hashes during analysis. A local branch needs a single trustworthy baseline; missing upstream history or an ambiguous merge base leaves coverage incomplete. The skill inspects repository evidence instead of running commands to reproduce a vulnerability, and it does not turn unfinished analysis into a clean result.

What it helps with

check pending changes before merging
spot vulnerabilities in a pull request
compare a branch against its resolved baseline
filter out low-confidence findings
mark incomplete security coverage

Example prompts for the agent

Run a security review of the current branch’s pending Git changes before merge.
Inspect this pull request for high-confidence vulnerabilities with a real exploitation path.
Review the specified commit range and show any part of the analysis that remains incomplete.

How to install security-review

1Skills CLI (Vercel)

npx skills add waybarrios/opencode-power-pack --skill security-review -a claude-code

2Manually: put the files in place

~/.claude/skills/security-review/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/security-review/

1Skills CLI (Vercel)

npx skills add waybarrios/opencode-power-pack --skill security-review -a codex

2Manually: put the files in place

.agents/skills/security-review/SKILL.md

For all projects use ~/.agents/skills/

1Skills CLI (Vercel)

npx skills add waybarrios/opencode-power-pack --skill security-review -a cursor

2Manually: put the files in place

.cursor/skills/security-review/SKILL.md

Cursor also reads .agents/skills/ and .claude/skills/

1GitHub CLI

gh skill install waybarrios/opencode-power-pack security-review

2Manually: put the files in place

.github/skills/security-review/SKILL.md

1Skills CLI (Vercel)

npx skills add waybarrios/opencode-power-pack --skill security-review -a gemini-cli

2Platform CLI

gemini skills install https://github.com/waybarrios/opencode-power-pack --path skills/security-review

Manually: put the files in place

.devin/skills/security-review/SKILL.md

The legacy .windsurf/skills/ path still works

Skills CLI (Vercel)

npx skills add waybarrios/opencode-power-pack --skill security-review -a opencode

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about security-review

How do I install security-review in Claude Code?

Run npx skills add waybarrios/opencode-power-pack --skill security-review -a claude-code, then open ~/.claude/skills/security-review/SKILL.md.

What does security-review do?

It examines a defined Git change set for high-confidence vulnerabilities with real exploitation potential. It is focused security analysis, not a general code review.

Does security-review run commands to reproduce vulnerabilities?

No. It inspects code and repository evidence without executing reproduction commands.

Similar skills

All skills for Security →

security-review by other authors comes first.

security-review official github Reviews code and dependencies for vulnerabilities, exposed secrets, and access-control flaws. Use it before a release or when auditing a project path. 5,500installs security-review getsentry Finds injections, XSS, authorization flaws, and other vulnerabilities in code. Reports only high-confidence findings. CX Codex +1 21,300installs git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. CX Codex +1 57,000installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. CX Codex +1 45,400installs security-audit cloudflare Reviews codebases and APIs for vulnerabilities using safe sandboxing. Fits pre-release security reviews, pen-test triage, and architecture checks. CX Codex +1 54,800installs security-and-hardening addyosmani Guides threat modeling and security checks for code that handles user input, authentication, sessions, or external services. Use it when building a feature that accepts untrusted data or reviewing code before release. CX Codex +1 70,200installs supabase official supabase Guides the agent through database configuration and strict RLS policies in Supabase. CX Codex GP ChatGPT 8installs

From the same set2

code-review Reviews pull requests and local diffs for bugs and convention violations using multi-agent checks. Helps uncover subtle logic flaws before merging changes. CX Codex +1 468installs