Agent skill

Security Review

Request a security expert assessment for code changes that touch child process spawning, file system access, configuration loading, or environment variable handling.

MITAuto-check passedSecurity

Install Security Review

skills CLI

$ npx skills add ktnyt/cclsp --skill security-review -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install ktnyt/cclsp security-review --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/ktnyt/cclsp.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.claude/skills/security-review .claude/skills/security-review && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "security-review" agent skill from https://github.com/ktnyt/cclsp/tree/main/.claude/skills/security-review into .claude/skills/security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-review", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/ktnyt/cclsp/tree/main/.claude/skills/security-review

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add ktnyt/cclsp --skill security-review -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install ktnyt/cclsp security-review --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/ktnyt/cclsp.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.claude/skills/security-review .agents/skills/security-review && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "security-review" agent skill from https://github.com/ktnyt/cclsp/tree/main/.claude/skills/security-review into .agents/skills/security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-review", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add ktnyt/cclsp --skill security-review -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install ktnyt/cclsp security-review --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/ktnyt/cclsp.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.claude/skills/security-review .cursor/skills/security-review && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "security-review" agent skill from https://github.com/ktnyt/cclsp/tree/main/.claude/skills/security-review into .cursor/skills/security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-review", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/ktnyt/cclsp.git --path .claude/skills/security-review

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add ktnyt/cclsp --skill security-review -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install ktnyt/cclsp security-review --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/ktnyt/cclsp.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.claude/skills/security-review .gemini/skills/security-review && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "security-review" agent skill from https://github.com/ktnyt/cclsp/tree/main/.claude/skills/security-review into .gemini/skills/security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-review", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install ktnyt/cclsp security-review

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add ktnyt/cclsp --skill security-review -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/ktnyt/cclsp.git skills-src && mkdir -p .github/skills && cp -r skills-src/.claude/skills/security-review .github/skills/security-review && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "security-review" agent skill from https://github.com/ktnyt/cclsp/tree/main/.claude/skills/security-review into .github/skills/security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-review", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add ktnyt/cclsp --skill security-review -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install ktnyt/cclsp security-review --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/ktnyt/cclsp.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.claude/skills/security-review .opencode/skills/security-review && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "security-review" agent skill from https://github.com/ktnyt/cclsp/tree/main/.claude/skills/security-review into .opencode/skills/security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-review", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: security-review
GitHub stars: 675
Token cost: ~565 tokens
SKILL.md length: 200 words
Files: 1
Skills in repo: 3
Repo updated: Feb 22, 2026
First seen: Oct 7, 2026
Licence: MIT

At a glance

Request a security expert assessment for code changes that touch child process spawning, file system access, configuration loading, or environment variable handling.

Works in 6 steps: Command injection: Are user-supplied… → Path traversal: Can file paths from LSP… → Resource exhaustion: Are there timeouts… → …
The Reviewer identifies security-sensitive changes in the MCP-LSP bridge
SKILL.md covers When to trigger, Review checklist, How to invoke and Output expectations
Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Security Review is an agent skill from ktnyt/cclsp. Request a security expert assessment for code changes that touch child process spawning, file system access, configuration loading, or environment variable handling. Use when the Reviewer identifies security-sensitive changes in the MCP-LSP bridge.

Its SKILL.md is about 570 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts. Compatibility notes: Designed for Claude Code (or similar products)

It sits in Security, covering Security review, Secrets management and MCP servers. It works with Model Context Protocol. The repository describes itself as: Claude Code LSP: enhance your Claude Code experience with non-IDE dependent LSP integration. The licence is MIT.

When your agent uses it

The Reviewer identifies security-sensitive changes in the MCP-LSP bridge
Tasks that involve Security review
Tasks that involve Secrets management

Example prompts

“/security-review”

Requirements

Compatibility (from SKILL.md): Designed for Claude Code (or similar products)

Workflow steps

6 steps, taken from the first numbered list in SKILL.md.

Command injection: Are user-supplied values (config file paths, server
Path traversal: Can file paths from LSP responses escape the project
Resource exhaustion: Are there timeouts on LSP server responses? Can a
Config trust boundary: Is cclsp.json treated as trusted input? What
Process cleanup: Are child processes reliably terminated on shutdown?
Symlink attacks: Does file resolution follow symlinks outside the

What it can do on your machine

Read from SKILL.md and the folder at commit 93414a1. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Compatibility
Designed for Claude Code (or similar products)
From compatibility in the SKILL.md frontmatter.

Context cost

Security Review loads about 565 tokens when it runs. Until then it costs about 66 tokens; SKILL.md has 200 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~66
When it runs · the whole SKILL.md, loaded when a task matches: ~565

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

Download SKILL.mdSave it as .claude/skills/security-review/SKILL.md (or your agent's skills folder).

name: security-review
description: Request a security expert assessment for code changes that touch child process spawning, file system access, configuration loading, or environment variable handling. Use when the Reviewer identifies security-sensitive changes in the MCP-LSP bridge.
compatibility: Designed for Claude Code (or similar products)
metadata.author: ktnyt
metadata.version: 1.0

Security Review

Invoke the security-reviewer agent to assess security-sensitive changes.

When to trigger

Child process spawning or lifecycle changes (src/lsp-client.ts)
File system read/write operations (src/file-editor.ts, src/file-scanner.ts)
Configuration file loading or parsing (cclsp.json, CCLSP_CONFIG_PATH)
Environment variable handling
New or modified LSP server adapter (src/lsp/adapters/)
Setup wizard input handling (src/setup.ts)

Review checklist

Command injection: Are user-supplied values (config file paths, server commands) sanitized before being passed to child_process spawn?
Path traversal: Can file paths from LSP responses escape the project root? Are file:// URIs validated before resolving?
Resource exhaustion: Are there timeouts on LSP server responses? Can a malicious LSP server cause unbounded memory growth?
Config trust boundary: Is cclsp.json treated as trusted input? What happens if it contains unexpected fields or types?
Process cleanup: Are child processes reliably terminated on shutdown? Can orphaned processes persist?
Symlink attacks: Does file resolution follow symlinks outside the project directory?

How to invoke

Use the everything-claude-code:security-reviewer agent via the Task tool:

Task(
  subagent_type: "everything-claude-code:security-reviewer",
  prompt: "Review the following changes for security concerns: <describe changes>"
)

Output expectations

The security reviewer should produce:

CRITICAL: Must fix before merge (injection, traversal, credential leak)
HIGH: Should fix before merge (missing timeouts, incomplete cleanup)
MEDIUM: Fix when possible (defensive checks, hardening opportunities)
LOW: Informational (best practice suggestions)

Files

Just SKILL.md in .claude/skills/security-review of ktnyt/cclsp.

Open the folder on GitHubat commit 93414a1

Compare with similar skills

Security Review next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Security Review compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Security Review this skillktnyt/cclsp	675	—	~565	Automated safety check: Pass	MIT	7 mo ago
MCP Security Auditgithub/awesome-copilot	40k	—	~3.1k	Automated safety check: Pass	MIT	yesterday
MCP Security Auditboshi-xixixi/TraeSkill	276	—	~2.2k	Automated safety check: Pass	MIT	5 mo ago
Ripwire Security Scanredhat-et/ripwire	2.4k	—	~2.8k	Automated safety check: Warn	Apache-2.0	today
Azure Compliancemicrosoft/GitHub-Copilot-for-Azure	255	2 repos	~997	Automated safety check: Pass	MIT	today
Security Passcyanheads/pubmed-mcp-server	158	—	~6.4k	Automated safety check: Pass	Apache-2.0	today

Similar skills

MCP Security Audit
github/awesome-copilot
Official
Audit MCP (Model Context Protocol) server configurations for security issues.
40k GitHub stars~3.1k tokensUpdated yesterday
SecurityAuto-check passed
MCP Security Audit
boshi-xixixi/TraeSkill
Audit MCP (Model Context Protocol) server configurations for security issues.
276 GitHub stars~2.2k tokensUpdated 5 mo ago
Agent WorkflowsAuto-check passed
Ripwire Security Scan
redhat-et/ripwire
Security review: (1) vet an untrusted SKILL.md or .mcp.json BEFORE installing it — the injection/exfiltration scanner; CRITICAL blocks the install; (2) audit code on an untrusted-input path (a…
2.4k GitHub stars~2.8k tokensUpdated today
SecurityAuto-check: warnings
Azure Compliance
microsoft/GitHub-Copilot-for-Azure
Official
Run Azure compliance and security audits with azqr plus Key Vault expiration checks.
255 GitHub starsUsed in 2 repos~997 tokens
SecurityAuto-check passed
Security Pass
cyanheads/pubmed-mcp-server
Review an MCP server for common security gaps: LLM-facing surfaces as injection vector (tools, resources, prompts, descriptions), scope blast radius, destructive ops without consent, upstream auth…
158 GitHub stars~6.4k tokensUpdated today
SecurityAuto-check passed
Tool Defs Analysis
cyanheads/pubmed-mcp-server
Read-only audit of MCP definition language across an existing surface — tools, resources, prompts, server instructions.
158 GitHub stars~4.9k tokensUpdated today
SecurityAuto-check passed

Questions about Security Review

What does Security Review do?

Request a security expert assessment for code changes that touch child process spawning, file system access, configuration loading, or environment variable handling. Security Review is an agent skill from ktnyt/cclsp. Request a security expert assessment for code changes that touch child process spawning, file system access, configuration loading, or environment variable handling.

When should I use Security Review?

Security Review fits situations like: the Reviewer identifies security-sensitive changes in the MCP-LSP bridge; tasks that involve Security review; tasks that involve Secrets management.

How do I install Security Review in Claude Code?

Run `npx skills add ktnyt/cclsp --skill security-review -a claude-code`. Or copy the skill folder (.claude/skills/security-review in ktnyt/cclsp) into .claude/skills/security-review in your project. Claude Code loads it when a task matches its description.

How do I install Security Review in Codex?

Run `npx skills add ktnyt/cclsp --skill security-review -a codex`. Or copy the skill folder (.claude/skills/security-review in ktnyt/cclsp) into .agents/skills/security-review in your project. Codex loads it when a task matches its description.

Can I use Security Review in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add ktnyt/cclsp --skill security-review -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/security-review, .gemini/skills/security-review, .github/skills/security-review and .opencode/skills/security-review in your project.

What does Security Review need to run?

SKILL.md names no scripts, command-line tools or credentials: Security Review is instructions for the agent only. Compatibility (from SKILL.md): Designed for Claude Code (or similar products).

Does Security Review access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Security Review safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Security Review use?

Security Review is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Security Review use?

About 565 tokens (SKILL.md is roughly 2.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Security Review?

Skills that share tags, products or a category with Security Review: MCP Security Audit (github/awesome-copilot, 40k stars), MCP Security Audit (boshi-xixixi/TraeSkill, 276 stars), Ripwire Security Scan (redhat-et/ripwire, 2.4k stars) and Azure Compliance (microsoft/GitHub-Copilot-for-Azure, 255 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Security Review?

ktnyt (a GitHub user) maintains it in ktnyt/cclsp, which has 675 GitHub stars. The repository holds 3 skills in this directory. The repository was last updated on February 22, 2026.

Source: ktnyt/cclsp on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Security Review

Install Security Review

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Compatibility

Context cost

Safety

SKILL.md

Security Review

When to trigger

Review checklist

How to invoke

Output expectations

Files

Compare with similar skills

Similar skills

MCP Security Audit

MCP Security Audit

Ripwire Security Scan

Azure Compliance

Security Pass

Tool Defs Analysis

More from ktnyt/cclsp

Architecture

Hands On Test

Questions about Security Review

Install Security Review

Facts

At a glance

What it does

When your agent uses it

Example prompts

Requirements

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Compatibility

Context cost

Safety

SKILL.md

Security Review

When to trigger

Review checklist

How to invoke

Output expectations

Files

Compare with similar skills

Similar skills

More from ktnyt/cclsp

Related

Questions about Security Review