Deepsec Documentation Guide
vercel-labs/deepsec
Points the agent at deepsec's own docs to answer questions about initializing, configuring, resuming, scanning with and extending the vulnerability scanner.
Review a PR through the CodeReviewSecurityReview persona. An agent skill from eric-tramel/moraine.
Install Code Review Security Review
$ npx skills add eric-tramel/moraine --skill code-review-security-review -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install eric-tramel/moraine code-review-security-review --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/eric-tramel/moraine.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/moraine-dev/skills/code-review-security-review .claude/skills/code-review-security-review && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "code-review-security-review" agent skill from https://github.com/eric-tramel/moraine/tree/main/plugins/moraine-dev/skills/code-review-security-review into .claude/skills/code-review-security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "code-review-security-review", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/eric-tramel/moraine/tree/main/plugins/moraine-dev/skills/code-review-security-reviewType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add eric-tramel/moraine --skill code-review-security-review -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install eric-tramel/moraine code-review-security-review --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/eric-tramel/moraine.git skills-src && mkdir -p .agents/skills && cp -r skills-src/plugins/moraine-dev/skills/code-review-security-review .agents/skills/code-review-security-review && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "code-review-security-review" agent skill from https://github.com/eric-tramel/moraine/tree/main/plugins/moraine-dev/skills/code-review-security-review into .agents/skills/code-review-security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "code-review-security-review", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add eric-tramel/moraine --skill code-review-security-review -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install eric-tramel/moraine code-review-security-review --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/eric-tramel/moraine.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/plugins/moraine-dev/skills/code-review-security-review .cursor/skills/code-review-security-review && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "code-review-security-review" agent skill from https://github.com/eric-tramel/moraine/tree/main/plugins/moraine-dev/skills/code-review-security-review into .cursor/skills/code-review-security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "code-review-security-review", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/eric-tramel/moraine.git --path plugins/moraine-dev/skills/code-review-security-review--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add eric-tramel/moraine --skill code-review-security-review -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install eric-tramel/moraine code-review-security-review --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/eric-tramel/moraine.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/plugins/moraine-dev/skills/code-review-security-review .gemini/skills/code-review-security-review && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "code-review-security-review" agent skill from https://github.com/eric-tramel/moraine/tree/main/plugins/moraine-dev/skills/code-review-security-review into .gemini/skills/code-review-security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "code-review-security-review", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install eric-tramel/moraine code-review-security-reviewInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add eric-tramel/moraine --skill code-review-security-review -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/eric-tramel/moraine.git skills-src && mkdir -p .github/skills && cp -r skills-src/plugins/moraine-dev/skills/code-review-security-review .github/skills/code-review-security-review && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "code-review-security-review" agent skill from https://github.com/eric-tramel/moraine/tree/main/plugins/moraine-dev/skills/code-review-security-review into .github/skills/code-review-security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "code-review-security-review", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add eric-tramel/moraine --skill code-review-security-review -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install eric-tramel/moraine code-review-security-review --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/eric-tramel/moraine.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/plugins/moraine-dev/skills/code-review-security-review .opencode/skills/code-review-security-review && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "code-review-security-review" agent skill from https://github.com/eric-tramel/moraine/tree/main/plugins/moraine-dev/skills/code-review-security-review into .opencode/skills/code-review-security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "code-review-security-review", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
code-review-security-review- GitHub stars
- 117
- Token cost
- ~497 tokens
- SKILL.md length
- 177 words
- Files
- 2
- Skills in repo
- 19
- Repo updated
- First seen
- Licence
- Apache-2.0
At a glance
Review a PR through the CodeReviewSecurityReview persona. An agent skill from eric-tramel/moraine.
- Asked to check whether code is safe
- SKILL.md covers Persona, Focus, Non-Goals and Output
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
- Avoids backdoors
What it does
Code Review Security Review is an agent skill from eric-tramel/moraine. Review a PR through the CodeReviewSecurityReview persona. Use when asked to check whether code is safe, avoids backdoors, vulnerable dependencies, injection attacks, auth bypasses, secret leaks, unsafe file/network behavior, and other security regressions.
Its SKILL.md is about 500 tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files (for example `agents/openai.yaml`).
It sits in Security, covering Security review, Vulnerability scanning and Code review. The repository describes itself as: Unified realtime agent trace database & search MCP. The licence is Apache-2.0.
When your agent uses it
- Asked to check whether code is safe
- Avoids backdoors
- Vulnerable dependencies
- Injection attacks
Example prompts
- “/code-review-security-review”
What it can do on your machine
Read from SKILL.md and the folder at commit 2fb4aec. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are markdown).
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Code Review Security Review loads about 497 tokens when it runs. Until then it costs about 71 tokens; SKILL.md has 177 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from eric-tramel/moraine at commit 2fb4aec, republished under its Apache-2.0 licence (© eric-tramel). 177 words, ~497 tokens.
Download SKILL.mdSave it as
.claude/skills/code-review-security-review/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.- name
- code-review-security-review
- description
- Review a PR through the CodeReviewSecurityReview persona. Use when asked to check whether code is safe, avoids backdoors, vulnerable dependencies, injection attacks, auth bypasses, secret leaks, unsafe file/network behavior, and other security regressions.
CodeReviewSecurityReview
Persona
Review for security risk. Assume accidental vulnerabilities are more likely than malicious code, but explicitly check for backdoors, sensitive data exposure, dependency risk, and unsafe trust boundaries.
Focus
- Check inputs that cross trust boundaries: user text, config, file paths, environment variables, HTTP data, database rows, and tool output.
- Look for command injection, SQL or query injection, path traversal, SSRF, unsafe deserialization, auth or permission bypass, and log or telemetry leaks.
- Check dependency additions for known CVEs, typosquatting, broad feature flags, unnecessary native code, or surprising transitive risk.
- Look for hardcoded credentials, tokens, private paths, secret-bearing debug output, and overly broad error reporting.
- Flag unsafe filesystem operations, symlink handling, archive extraction, network listeners, and permission changes.
Non-Goals
Do not demand enterprise security machinery for local-only developer tooling unless the changed code crosses a real trust boundary. Do not report theoretical risk without a plausible path.
Output
Lead with exploitable or sensitive findings. Include the attack or leak path:
- [P1] Reject absolute paths before opening trace files
`crates/example/src/import.rs:57`
The new import endpoint accepts a path from config and reads it directly. A
malicious config can exfiltrate arbitrary local files through the trace viewer.
Restrict reads to the configured watch root after canonicalization.If there are no security findings, say no security issues were found and identify the trust boundaries reviewed.
© eric-tramel, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 1 other file in plugins/moraine-dev/skills/code-review-security-review of eric-tramel/moraine.
- SKILL.md
- agents/openai.yaml
Open the folder on GitHubat commit 2fb4aec
Compare with similar skills
Code Review Security Review next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Code Review Security Review this skilleric-tramel/moraine | 117 | — | ~497 | Automated safety check: Pass | Apache-2.0 | |
| Deepsec Documentation Guidevercel-labs/deepsec | 8.1k | — | ~956 | Automated safety check: Pass | Apache-2.0 | |
| Native Dependency Updatemono/SkiaSharp | 5.6k | — | ~4.1k | Automated safety check: Pass | MIT | |
| Skillward AuditFangcun-AI/SkillWard | 143 | — | ~2.9k | Automated safety check: Pass | Custom licence | |
| Security AuditTheDecipherist/claude-code-mastery | 550 | — | ~1.3k | Automated safety check: Notes | MIT | |
| Vbs Scan Securitytanviet12/vbsec | 287 | — | ~5.3k | Automated safety check: Notes | MIT |
Similar skills
- Official
Native Dependency Update
mono/SkiaSharp
Update native dependencies (libpng, libexpat, zlib, libwebp, harfbuzz, freetype, libjpeg-turbo, etc.) in SkiaSharp's Skia fork.
Skillward Audit
Fangcun-AI/SkillWard
Security-audit a third-party skill bundle (folder with SKILL.md, or .zip / .tar.gz archive) before installing it, using the SkillWard cloud scanner.
Security Audit
TheDecipherist/claude-code-mastery
Checks a codebase for hardcoded secrets, vulnerable dependencies, weak input handling, weak authentication and unsafe transport settings before deployment or merge.
Vbs Scan Security
tanviet12/vbsec
A skill your agent uses when scanning code for security vulnerabilities.
Cyberowlai
karimhabush/cyberowl
Check if recent cybersecurity alerts from 10 international CERTs affect your current project.
More from eric-tramel/moraine
All 19 skills in this repoMoraine Release Publisher
eric-tramel/moraine
Cuts and publishes a Moraine release end to end: version bump PR, tag, GitHub release notes, workflow check and PyPI package verification.
Moraine Release Notes
eric-tramel/moraine
Rewrites a moraine GitHub release body into a usage-focused format with install block, what's new, platform table, upgrade notes and one deduplicated changelog.
Multi-Persona Code Review
eric-tramel/moraine
Coordinates a delegated review of a Moraine PR or local change by seven focused reviewer subagents, merges their findings and follows up on the fixes.
Elegance-Focused Code Review
eric-tramel/moraine
Looks at a pull request for the smallest good design, hunting for simplifications and architectural moves that remove whole classes of problems.
Idiomatic Code Review
eric-tramel/moraine
Reviews a pull request for idiomatic implementation: use of the language, standard library, ecosystem conventions and the repository's own patterns.
Crystallize
eric-tramel/moraine
Turn a rough feature, bug, refactor, architecture, documentation, or operations idea into a ready-to-implement local plan file.
Related
Categories
Questions about Code Review Security Review
What does Code Review Security Review do?
Review a PR through the CodeReviewSecurityReview persona. An agent skill from eric-tramel/moraine. Code Review Security Review is an agent skill from eric-tramel/moraine. Review a PR through the CodeReviewSecurityReview persona.
When should I use Code Review Security Review?
Code Review Security Review fits situations like: asked to check whether code is safe; avoids backdoors; vulnerable dependencies; injection attacks.
How do I install Code Review Security Review in Claude Code?
Run `npx skills add eric-tramel/moraine --skill code-review-security-review -a claude-code`. Or copy the skill folder (plugins/moraine-dev/skills/code-review-security-review in eric-tramel/moraine) into .claude/skills/code-review-security-review in your project. Claude Code loads it when a task matches its description.
How do I install Code Review Security Review in Codex?
Run `npx skills add eric-tramel/moraine --skill code-review-security-review -a codex`. Or copy the skill folder (plugins/moraine-dev/skills/code-review-security-review in eric-tramel/moraine) into .agents/skills/code-review-security-review in your project. Codex loads it when a task matches its description.
Can I use Code Review Security Review in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add eric-tramel/moraine --skill code-review-security-review -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/code-review-security-review, .gemini/skills/code-review-security-review, .github/skills/code-review-security-review and .opencode/skills/code-review-security-review in your project.
What does Code Review Security Review need to run?
SKILL.md names no scripts, command-line tools or credentials: Code Review Security Review is instructions for the agent only.
Does Code Review Security Review access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Code Review Security Review safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Code Review Security Review use?
Code Review Security Review is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Code Review Security Review use?
About 497 tokens (SKILL.md is roughly 2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Code Review Security Review?
Skills that share tags, products or a category with Code Review Security Review: Deepsec Documentation Guide (vercel-labs/deepsec, 8.1k stars), Native Dependency Update (mono/SkiaSharp, 5.6k stars), Skillward Audit (Fangcun-AI/SkillWard, 143 stars) and Security Audit (TheDecipherist/claude-code-mastery, 550 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Code Review Security Review?
eric-tramel (a GitHub user) maintains it in eric-tramel/moraine, which has 117 GitHub stars. The repository holds 19 skills in this directory. The repository was last updated on October 5, 2026.
Source: eric-tramel/moraine on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.