New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Review Security

by hashgraph-online in hashgraph-online/awesome-codex-plugins

Review application and infrastructure changes for exploitable security risks by tracing assets, trust boundaries, attacker-controlled input, authorization, sensitive data, and dangerous sinks.

Apache-2.0Auto-check passedSecurity

Install Review Security

skills CLI
$ npx skills add hashgraph-online/awesome-codex-plugins --skill review-security -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install hashgraph-online/awesome-codex-plugins review-security --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/hashgraph-online/awesome-codex-plugins.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/Phelan164/codex-howto/skills/review-security .claude/skills/review-security && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
review-security
GitHub stars
1.3k
Token cost
~601 tokens
SKILL.md length
223 words
Files
3 (incl. references)
Skills in repo
714
Repo updated
First seen
Licence
Apache-2.0

At a glance

Review application and infrastructure changes for exploitable security risks by tracing assets, trust boundaries, attacker-controlled input, authorization, sensitive data, and dangerous sinks.

  • Works in 7 steps: Establish the review target, intended… → Identify assets, trust boundaries,… → Trace attacker-controlled data to… → …
  • Security reviews
  • SKILL.md covers Workflow, Guardrails, Threat checklist and Finding standard, plus 1 more section
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Review Security is an agent skill from hashgraph-online/awesome-codex-plugins. Review application and infrastructure changes for exploitable security risks by tracing assets, trust boundaries, attacker-controlled input, authorization, sensitive data, and dangerous sinks. Use for security reviews, threat-focused PR reviews, authentication or authorization changes, input handling, secrets, dependencies, and infrastructure permissions; do not use to exploit live systems or modify code unless separately requested.

Its SKILL.md is about 600 tokens, which your agent loads only when the skill is triggered. The skill folder holds 4 other files, including reference files (for example `agents/openai.yaml` and `references/threat-checklist.md`).

It sits in Security, covering Pull requests, Security review and Authorization and RBAC. The repository describes itself as: A curated list of awesome OpenAI Codex / ChatGPT plugins, skills, and resources. The 1 Codex Marketplace. See live plugins at: https://hol.org/plugins/best-codex-plugins. The licence is Apache-2.0.

When your agent uses it

  • Security reviews
  • Threat-focused PR reviews
  • Authorization changes
  • Infrastructure permissions

Example prompts

  • “/review-security”

Workflow steps

7 steps, taken from the first numbered list in SKILL.md.

  1. Establish the review target, intended behavior, and relevant threat model.
  2. Identify assets, trust boundaries, actors, entry points, and sensitive operations.
  3. Trace attacker-controlled data to security-relevant sinks.
  4. Inspect authentication, authorization, tenant isolation, and privilege changes.
  5. Evaluate realistic exploitability and existing controls.
  6. Validate suspected findings safely with read-only analysis or sandboxed tests when authorized.
  7. Return prioritized findings with evidence, impact, prerequisites, and remediation direction.

What it can do on your machine

Read from SKILL.md and the folder at commit 9e7b281. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Review Security loads about 601 tokens when it runs, and up to ~1.2k if it reads all its reference files. Until then it costs about 113 tokens; SKILL.md has 223 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~113
When it runs · the whole SKILL.md, loaded when a task matches
~601
With references · SKILL.md plus every file in references/, read only if the agent opens them
~1.2k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from hashgraph-online/awesome-codex-plugins at commit 9e7b281, republished under its Apache-2.0 licence (© hashgraph-online). 223 words, ~601 tokens.

Download SKILL.mdSave it as .claude/skills/review-security/SKILL.md (or your agent's skills folder). This skill also uses 2 other files; get the full folder from GitHub.
name
review-security
description
Review application and infrastructure changes for exploitable security risks by tracing assets, trust boundaries, attacker-controlled input, authorization, sensitive data, and dangerous sinks. Use for security reviews, threat-focused PR reviews, authentication or authorization changes, input handling, secrets, dependencies, and infrastructure permissions; do not use to exploit live systems or modify code unless separately requested.

Review Security

Workflow

  1. Establish the review target, intended behavior, and relevant threat model.
  2. Identify assets, trust boundaries, actors, entry points, and sensitive operations.
  3. Trace attacker-controlled data to security-relevant sinks.
  4. Inspect authentication, authorization, tenant isolation, and privilege changes.
  5. Evaluate realistic exploitability and existing controls.
  6. Validate suspected findings safely with read-only analysis or sandboxed tests when authorized.
  7. Return prioritized findings with evidence, impact, prerequisites, and remediation direction.

Guardrails

  • Work read-only by default.
  • Do not access production systems, real customer data, or private credentials.
  • Do not publish weaponized exploit details or active secrets.
  • Avoid checklist-only findings without a reachable attack path.
  • Distinguish a missing defense-in-depth measure from an exploitable vulnerability.
  • Treat dependency scanner output as leads requiring context.
  • Keep proof-of-concept activity scoped, reversible, and authorized.

Threat checklist

Read references/threat-checklist.md for changes involving identity, parsers, URLs, files, commands, serialization, secrets, data boundaries, CI, or cloud permissions.

Finding standard

Include:

  • severity and confidence;
  • affected asset and trust boundary;
  • attacker prerequisites;
  • source-to-sink or authorization path;
  • impact;
  • exact code location;
  • safe reproduction guidance when appropriate;
  • remediation and verification direction.

Acceptance criteria

  • Findings describe realistic attack paths.
  • Authorization and tenant boundaries are explicitly reviewed.
  • Sensitive data handling is traced through logs and storage.
  • False positives and assumptions are called out.
  • No live exploitation or unauthorized write occurred.
  • Residual risk and unreviewed surfaces are explicit.

© hashgraph-online, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 2 other files (references) in plugins/Phelan164/codex-howto/skills/review-security of hashgraph-online/awesome-codex-plugins.

  • SKILL.md
  • agents/openai.yaml
  • references/threat-checklist.md

Open the folder on GitHubat commit 9e7b281

Compare with similar skills

Review Security next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Review Security compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Review Security this skillhashgraph-online/awesome-codex-plugins1.3k—~601Automated safety check: PassApache-2.0
Security Review Specwarpdotdev/oz-for-oss3131 repos~2.6kAutomated safety check: PassMIT
Review Hog Perspective Contracts SecurityPostHog/posthog40k—~1kAutomated safety check: PassCustom licence
Vercel Security Basicsjeremylongshore/tons-of-skills-marketplace2.8k—~1.9kAutomated safety check: NotesMIT
Security Architecture Reviewcbrock84/headcount2k—~1.1kAutomated safety check: PassMIT
Framer Security Basicsjeremylongshore/tons-of-skills-marketplace2.8k—~767Automated safety check: NotesMIT

Similar skills

  • Security Review Spec

    warpdotdev/oz-for-oss

    Audit a product or tech spec pull request diff for high-level security concerns (threat surface, authentication and authorization model, trust boundaries, sensitive data handling, secrets and key…

    313 GitHub starsUsed in 1 repo~2.6k tokens
    SecurityAuto-check passed

  • Vercel Security Basics

    jeremylongshore/tons-of-skills-marketplace

    Apply Vercel security best practices for secrets, headers, and access control.

    2.8k GitHub stars~1.9k tokensUpdated yesterday
    SecurityAuto-check: notes

  • Security Architecture Review

    cbrock84/headcount

    Reviews a design or change for security before it ships — authentication and authorization, data handling, secrets, dependencies, and the secure-development practices around it.

    2k GitHub stars~1.1k tokensUpdated 22 days ago
    SecurityAuto-check passed

  • Framer Security Basics

    jeremylongshore/tons-of-skills-marketplace

    Apply Framer security best practices for secrets and access control.

    2.8k GitHub stars~767 tokensUpdated yesterday
    SecurityAuto-check: notes

  • Security Review Checklist

    ZeroDeng01/sublinkPro

    Checklist-driven security review for changes to authentication, authorization, MFA, secrets, input validation and other security-critical code.

    1.7k GitHub stars~2.3k tokensUpdated today
    SecurityAuto-check passed

More from hashgraph-online/awesome-codex-plugins

All 714 skills in this repo

  • Anime Reaction Gif

    hashgraph-online/awesome-codex-plugins

    Create original anime-style reaction stickers as looping GIFs and MP4 previews, using generated character pose sheets and timed key poses.

    1.3k GitHub stars~922 tokensUpdated yesterday
    Auto-check passed

  • Calibredb

    hashgraph-online/awesome-codex-plugins

    Manage and query Calibre libraries with the calibredb CLI (local paths or Calibre Content server URLs).

    1.3k GitHub stars~1k tokensUpdated yesterday
    Auto-check passed

  • Rust API Test Harness

    hashgraph-online/awesome-codex-plugins

    A skill your agent uses when adding, changing, testing, or debugging Rust HTTP APIs and services, especially when Codex needs black-box integration tests, random-port app startup, real database test…

    1.3k GitHub stars~1.7k tokensUpdated yesterday
    Auto-check passed

  • Art

    hashgraph-online/awesome-codex-plugins

    Make a studio's game look like something at build time — a cover from a real frame of the game (free), painted covers, backdrops, textures and character plates from image models through the…

    1.3k GitHub stars~2.4k tokensUpdated yesterday
    Auto-check passed

  • Calle

    hashgraph-online/awesome-codex-plugins

    Use CALL-E from Codex through the calle CLI. An agent skill from hashgraph-online/awesome-codex-plugins.

    1.3k GitHub stars~2.9k tokensUpdated yesterday
    Auto-check passed

  • Game Balance Economy

    hashgraph-online/awesome-codex-plugins

    Balance game difficulty, resources, rewards, probability, progression, economies, and dominant strategies.

    1.3k GitHub stars~618 tokensUpdated yesterday
    Auto-check passed

Categories

Questions about Review Security

What does Review Security do?

Review application and infrastructure changes for exploitable security risks by tracing assets, trust boundaries, attacker-controlled input, authorization, sensitive data, and dangerous sinks. Review Security is an agent skill from hashgraph-online/awesome-codex-plugins. Review application and infrastructure changes for exploitable security risks by tracing assets, trust boundaries, attacker-controlled input, authorization, sensitive data, and dangerous sinks.

When should I use Review Security?

Review Security fits situations like: security reviews; threat-focused PR reviews; authorization changes; infrastructure permissions.

How do I install Review Security in Claude Code?

Run `npx skills add hashgraph-online/awesome-codex-plugins --skill review-security -a claude-code`. Or copy the skill folder (plugins/Phelan164/codex-howto/skills/review-security in hashgraph-online/awesome-codex-plugins) into .claude/skills/review-security in your project. Claude Code loads it when a task matches its description.

How do I install Review Security in Codex?

Run `npx skills add hashgraph-online/awesome-codex-plugins --skill review-security -a codex`. Or copy the skill folder (plugins/Phelan164/codex-howto/skills/review-security in hashgraph-online/awesome-codex-plugins) into .agents/skills/review-security in your project. Codex loads it when a task matches its description.

Can I use Review Security in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add hashgraph-online/awesome-codex-plugins --skill review-security -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/review-security, .gemini/skills/review-security, .github/skills/review-security and .opencode/skills/review-security in your project.

What does Review Security need to run?

SKILL.md names no scripts, command-line tools or credentials: Review Security is instructions for the agent only.

Does Review Security access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Review Security safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Review Security use?

Review Security is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Review Security use?

About 601 tokens (SKILL.md is roughly 2.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 622 tokens, read only when the agent opens those files.

What are the alternatives to Review Security?

Skills that share tags, products or a category with Review Security: Security Review Spec (warpdotdev/oz-for-oss, 313 stars), Review Hog Perspective Contracts Security (PostHog/posthog, 40k stars), Vercel Security Basics (jeremylongshore/tons-of-skills-marketplace, 2.8k stars) and Security Architecture Review (cbrock84/headcount, 2k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Review Security?

hashgraph-online (a GitHub organization) maintains it in hashgraph-online/awesome-codex-plugins, which has 1,255 GitHub stars. The repository holds 714 skills in this directory. The repository was last updated on October 9, 2026.

Source: hashgraph-online/awesome-codex-plugins on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.