Wooyun Legacy
tanweai/wooyun-legacy
WooYun business logic vulnerability methodology — 22,132 real cases across 6 domains (authentication bypass, authorization bypass, payment tampering, information disclosure, logic flaws…
Dedicated security-audit route for OWASP-style risks, secret leaks, auth flaws, injection, unsafe input handling, SSRF/XSS, and sensitive-data exposure.
Install Security Reviewer
$ npx skills add foryourhealth111-pixel/Vibe-Skills --skill security-reviewer -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install foryourhealth111-pixel/Vibe-Skills security-reviewer --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/foryourhealth111-pixel/Vibe-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/bundled/skills/security-reviewer .claude/skills/security-reviewer && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "security-reviewer" agent skill from https://github.com/foryourhealth111-pixel/Vibe-Skills/tree/main/bundled/skills/security-reviewer into .claude/skills/security-reviewer/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-reviewer", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/foryourhealth111-pixel/Vibe-Skills/tree/main/bundled/skills/security-reviewerType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add foryourhealth111-pixel/Vibe-Skills --skill security-reviewer -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install foryourhealth111-pixel/Vibe-Skills security-reviewer --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/foryourhealth111-pixel/Vibe-Skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/bundled/skills/security-reviewer .agents/skills/security-reviewer && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "security-reviewer" agent skill from https://github.com/foryourhealth111-pixel/Vibe-Skills/tree/main/bundled/skills/security-reviewer into .agents/skills/security-reviewer/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-reviewer", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add foryourhealth111-pixel/Vibe-Skills --skill security-reviewer -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install foryourhealth111-pixel/Vibe-Skills security-reviewer --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/foryourhealth111-pixel/Vibe-Skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/bundled/skills/security-reviewer .cursor/skills/security-reviewer && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "security-reviewer" agent skill from https://github.com/foryourhealth111-pixel/Vibe-Skills/tree/main/bundled/skills/security-reviewer into .cursor/skills/security-reviewer/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-reviewer", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/foryourhealth111-pixel/Vibe-Skills.git --path bundled/skills/security-reviewer--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add foryourhealth111-pixel/Vibe-Skills --skill security-reviewer -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install foryourhealth111-pixel/Vibe-Skills security-reviewer --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/foryourhealth111-pixel/Vibe-Skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/bundled/skills/security-reviewer .gemini/skills/security-reviewer && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "security-reviewer" agent skill from https://github.com/foryourhealth111-pixel/Vibe-Skills/tree/main/bundled/skills/security-reviewer into .gemini/skills/security-reviewer/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-reviewer", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install foryourhealth111-pixel/Vibe-Skills security-reviewerInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add foryourhealth111-pixel/Vibe-Skills --skill security-reviewer -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/foryourhealth111-pixel/Vibe-Skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/bundled/skills/security-reviewer .github/skills/security-reviewer && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "security-reviewer" agent skill from https://github.com/foryourhealth111-pixel/Vibe-Skills/tree/main/bundled/skills/security-reviewer into .github/skills/security-reviewer/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-reviewer", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add foryourhealth111-pixel/Vibe-Skills --skill security-reviewer -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install foryourhealth111-pixel/Vibe-Skills security-reviewer --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/foryourhealth111-pixel/Vibe-Skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/bundled/skills/security-reviewer .opencode/skills/security-reviewer && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "security-reviewer" agent skill from https://github.com/foryourhealth111-pixel/Vibe-Skills/tree/main/bundled/skills/security-reviewer into .opencode/skills/security-reviewer/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-reviewer", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
security-reviewer- GitHub stars
- 3.6k
- Token cost
- ~523 tokens
- SKILL.md length
- 220 words
- Files
- 1
- Skills in repo
- 81
- Repo updated
- First seen
- Licence
- Apache-2.0
At a glance
Dedicated security-audit route for OWASP-style risks, secret leaks, auth flaws, injection, unsafe input handling, SSRF/XSS, and sensitive-data exposure.
- Tasks that involve Web application vulnerabilities
- SKILL.md covers Routing Boundary, Security Review Workflow and Vibe Integration
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
- Tasks that involve Security review
What it does
Security Reviewer is an agent skill from foryourhealth111-pixel/Vibe-Skills. Dedicated security-audit route for OWASP-style risks, secret leaks, auth flaws, injection, unsafe input handling, SSRF/XSS, and sensitive-data exposure. Use instead of code-reviewer when the prompt explicitly asks for security, vulnerability, threat, auth, or OWASP review.
Its SKILL.md is about 520 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security, covering Web application vulnerabilities, Security review and Code review. The repository describes itself as: Intelligent Skill routing and workflow orchestration for AI agents — +21.12 pp reward, −29.6% tokens on SkillsBench with DeepSeekV4Flash-VE. The licence is Apache-2.0.
When your agent uses it
- Tasks that involve Web application vulnerabilities
- Tasks that involve Security review
- Tasks that involve Code review
Example prompts
- “/security-reviewer”
What it can do on your machine
Read from SKILL.md and the folder at commit ddcaa2a. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Security Reviewer loads about 523 tokens when it runs. Until then it costs about 73 tokens; SKILL.md has 220 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from foryourhealth111-pixel/Vibe-Skills at commit ddcaa2a, republished under its Apache-2.0 licence (© foryourhealth111-pixel). 220 words, ~523 tokens.
Download SKILL.mdSave it as
.claude/skills/security-reviewer/SKILL.md (or your agent's skills folder).- name
- security-reviewer
- description
- Dedicated security-audit route for OWASP-style risks, secret leaks, auth flaws, injection, unsafe input handling, SSRF/XSS, and sensitive-data exposure. Use instead of code-reviewer when the prompt explicitly asks for security, vulnerability, threat, auth, or OWASP review.
security-reviewer (Codex Compatibility)
Use this skill after code changes that touch input handling, auth, APIs, data access, uploads, payments, or external integrations.
Routing Boundary
Use this skill when security is the main question:
- OWASP/security audit/security review
- secret leak, token exposure, unsafe logging
- auth bypass, authorization gaps, session/token handling
- injection, XSS, SSRF, unsafe file upload or command execution
Do not use this as the default owner for ordinary maintainability review. If security is only one item in a general PR review, code-reviewer can flag it, but explicit security-audit wording should route here.
Security Review Workflow
- Initial Scan
- Locate auth, API endpoints, DB queries, file handling, and external calls.
- Check for hardcoded secrets and unsafe config defaults.
- OWASP-Oriented Checks
- Injection: parameterized queries, sanitized inputs.
- AuthZ/AuthN: enforce authorization per route, secure session/token handling.
- Data exposure: secrets/PII protection and safe logging.
- XSS/SSRF: output encoding, URL allowlist, no blind fetch of user URLs.
- Dependency risk: audit vulnerable dependencies.
- High-Risk Pattern Audit
- Hardcoded secrets/tokens
- Command execution with user input
- SQL string concatenation
- Missing auth check
- Missing rate limiting on sensitive endpoints
- Unsafe crypto/password handling
- Remediation Output
- Severity (CRITICAL/HIGH/MEDIUM/LOW)
- Evidence (file + line + risk)
- Concrete fix proposal
- Verification steps after fix
Vibe Integration
- Security gate skill usable at any grade.
- Pair with
security-best-practicesfor language/framework-specific guidance. - Pair with
code-reviewerfor combined correctness + security review.
© foryourhealth111-pixel, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in bundled/skills/security-reviewer of foryourhealth111-pixel/Vibe-Skills.
Open the folder on GitHubat commit ddcaa2a
Compare with similar skills
Security Reviewer next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Security Reviewer this skillforyourhealth111-pixel/Vibe-Skills | 3.6k | — | ~523 | Automated safety check: Pass | Apache-2.0 | |
| Wooyun Legacytanweai/wooyun-legacy | 1.8k | — | ~1.9k | Automated safety check: Pass | Custom licence | |
| Security Reviewgetsentry/skills | 1k | 4 repos | ~2.9k | Automated safety check: Notes | CC-BY-SA-4.0 | |
| Performing Security Code Reviewjeremylongshore/tons-of-skills-marketplace | 2.8k | 2 repos | ~1.3k | Automated safety check: Notes | MIT | |
| Security Reviewdeadlock-mod-manager/deadlock-mod-manager | 478 | — | ~1.8k | Automated safety check: Pass | CC-BY-SA-4.0 | |
| Security Auditorpavel-molyanov/molyanov-ai-dev | 297 | — | ~566 | Automated safety check: Pass | MIT |
Similar skills
- Official
Security Review
getsentry/skills
Security code review for vulnerabilities. An agent skill from getsentry/skills.
Performing Security Code Review
jeremylongshore/tons-of-skills-marketplace
Execute this skill enables AI assistant to conduct a security-focused code review using the security-agent plugin.
Security Review
deadlock-mod-manager/deadlock-mod-manager
Security code review for Tauri/Rust/TypeScript desktop apps and Hono/oRPC APIs.
Security Auditor
pavel-molyanov/molyanov-ai-dev
Analyzes changed security boundaries against applicable OWASP risks and project contracts.
Secure Code Review
Hack23/cia
Conduct comprehensive security code reviews using OWASP Top 10, SAST/DAST patterns, and Hack23 ISMS secure development policy
More from foryourhealth111-pixel/Vibe-Skills
All 81 skills in this repoMarket Research Reports
foryourhealth111-pixel/Vibe-Skills
Produces long consulting-style market research and industry reports covering market sizing, competitive landscape, market entry and investment theses.
Academic Venue Templates
foryourhealth111-pixel/Vibe-Skills
Supplies venue-specific LaTeX templates and formatting rules for journals, conferences and posters, and checks a manuscript against page limits and submission requirements.
Digital Brain
foryourhealth111-pixel/Vibe-Skills
This skill should be used when the user asks to "write a post", "check my voice", "look up contact", "prepare for meeting", "weekly review", "track goals", or mentions personal brand, content…
Smart File Writer
foryourhealth111-pixel/Vibe-Skills
Diagnoses why a file write failed (permissions, disk space, path length, locks, read-only mounts) before retrying, instead of repeating the same call blindly.
Automated Video Studio
foryourhealth111-pixel/Vibe-Skills
Turns footage, audio and a storyboard plan into a finished short video with FFmpeg jump-cuts, subtitle burn-in and a final polish pass.
Citation Management
foryourhealth111-pixel/Vibe-Skills
Turns DOIs, PMIDs and arXiv IDs into clean BibTeX, searches Google Scholar and PubMed, and checks and deduplicates a reference list.
Related
Categories
Questions about Security Reviewer
What does Security Reviewer do?
Dedicated security-audit route for OWASP-style risks, secret leaks, auth flaws, injection, unsafe input handling, SSRF/XSS, and sensitive-data exposure. Security Reviewer is an agent skill from foryourhealth111-pixel/Vibe-Skills. Dedicated security-audit route for OWASP-style risks, secret leaks, auth flaws, injection, unsafe input handling, SSRF/XSS, and sensitive-data exposure.
When should I use Security Reviewer?
Security Reviewer fits situations like: tasks that involve Web application vulnerabilities; tasks that involve Security review; tasks that involve Code review.
How do I install Security Reviewer in Claude Code?
Run `npx skills add foryourhealth111-pixel/Vibe-Skills --skill security-reviewer -a claude-code`. Or copy the skill folder (bundled/skills/security-reviewer in foryourhealth111-pixel/Vibe-Skills) into .claude/skills/security-reviewer in your project. Claude Code loads it when a task matches its description.
How do I install Security Reviewer in Codex?
Run `npx skills add foryourhealth111-pixel/Vibe-Skills --skill security-reviewer -a codex`. Or copy the skill folder (bundled/skills/security-reviewer in foryourhealth111-pixel/Vibe-Skills) into .agents/skills/security-reviewer in your project. Codex loads it when a task matches its description.
Can I use Security Reviewer in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add foryourhealth111-pixel/Vibe-Skills --skill security-reviewer -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/security-reviewer, .gemini/skills/security-reviewer, .github/skills/security-reviewer and .opencode/skills/security-reviewer in your project.
What does Security Reviewer need to run?
SKILL.md names no scripts, command-line tools or credentials: Security Reviewer is instructions for the agent only.
Does Security Reviewer access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Security Reviewer safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Security Reviewer use?
Security Reviewer is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Security Reviewer use?
About 523 tokens (SKILL.md is roughly 2.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Security Reviewer?
Skills that share tags, products or a category with Security Reviewer: Wooyun Legacy (tanweai/wooyun-legacy, 1.8k stars), Security Review (getsentry/skills, 1k stars), Performing Security Code Review (jeremylongshore/tons-of-skills-marketplace, 2.8k stars) and Security Review (deadlock-mod-manager/deadlock-mod-manager, 478 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Security Reviewer?
foryourhealth111-pixel (a GitHub user) maintains it in foryourhealth111-pixel/Vibe-Skills, which has 3,627 GitHub stars. The repository holds 81 skills in this directory. The repository was last updated on August 31, 2026.
Source: foryourhealth111-pixel/Vibe-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.