# security-review

Checks Git changes for high-confidence vulnerabilities with a credible exploitation path. Use it before merging when a general code review is not enough.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 747 installs · ★ 543
- Author: waybarrios
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/waybarrios/opencode-power-pack/tree/HEAD/skills/security-review/SKILL.md
- Updated: 2026-10-19
- HTML: https://affpapa.org/en/nevibecode/skills/waybarrios-security-review

## What it does

This skill examines one frozen change set and reports only vulnerabilities introduced by that set when the exploitation case is well supported. It can review pending work on a branch, a pull request, or an explicit commit range. It is not a general code review, so style and ordinary correctness checks are outside its purpose.

The workflow resolves the review boundary, snapshots relevant worktree data, and verifies content hashes during analysis. A local branch needs a single trustworthy baseline; missing upstream history or an ambiguous merge base leaves coverage incomplete. The skill inspects repository evidence instead of running commands to reproduce a vulnerability, and it does not turn unfinished analysis into a clean result.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add waybarrios/opencode-power-pack --skill security-review -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/security-review/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/security-review/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add waybarrios/opencode-power-pack --skill security-review -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/security-review/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add waybarrios/opencode-power-pack --skill security-review -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/security-review/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install waybarrios/opencode-power-pack security-review
```

2. **Manually: put the files in place**
- File: `.github/skills/security-review/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add waybarrios/opencode-power-pack --skill security-review -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/waybarrios/opencode-power-pack --path skills/security-review
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/security-review/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add waybarrios/opencode-power-pack --skill security-review -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/waybarrios/opencode-power-pack/tree/HEAD/skills/security-review/SKILL.md

## When to use it
- check pending changes before merging
- spot vulnerabilities in a pull request
- compare a branch against its resolved baseline
- filter out low-confidence findings
- mark incomplete security coverage

## Example prompts
- Run a security review of the current branch’s pending Git changes before merge.
- Inspect this pull request for high-confidence vulnerabilities with a real exploitation path.
- Review the specified commit range and show any part of the analysis that remains incomplete.

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

## Other versions with the same name
- [security-review · github](https://affpapa.org/en/nevibecode/skills/security-review.md) — 5500 installs
- [security-review · getsentry](https://affpapa.org/en/nevibecode/skills/getsentry-security-review.md) — 21300 installs

From the same set: [waybarrios/opencode-power-pack](https://affpapa.org/en/nevibecode/by/waybarrios/opencode-power-pack.md) — 2 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md