Commit Security Scan
codexstar69/bug-hunter
Scan code changes for security vulnerabilities using Bug Hunter-native artifacts and STRIDE context.
Perform a security-focused review of current git changes. An agent skill from SpecterOps/skills.
Install Security Review
$ npx skills add SpecterOps/skills --skill security-review -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install SpecterOps/skills security-review --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/SpecterOps/skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/ops-appsec/skills/security-review .claude/skills/security-review && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "security-review" agent skill from https://github.com/SpecterOps/skills/tree/main/plugins/ops-appsec/skills/security-review into .claude/skills/security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-review", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/SpecterOps/skills/tree/main/plugins/ops-appsec/skills/security-reviewType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add SpecterOps/skills --skill security-review -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install SpecterOps/skills security-review --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/SpecterOps/skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/plugins/ops-appsec/skills/security-review .agents/skills/security-review && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "security-review" agent skill from https://github.com/SpecterOps/skills/tree/main/plugins/ops-appsec/skills/security-review into .agents/skills/security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-review", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add SpecterOps/skills --skill security-review -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install SpecterOps/skills security-review --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/SpecterOps/skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/plugins/ops-appsec/skills/security-review .cursor/skills/security-review && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "security-review" agent skill from https://github.com/SpecterOps/skills/tree/main/plugins/ops-appsec/skills/security-review into .cursor/skills/security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-review", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/SpecterOps/skills.git --path plugins/ops-appsec/skills/security-review--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add SpecterOps/skills --skill security-review -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install SpecterOps/skills security-review --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/SpecterOps/skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/plugins/ops-appsec/skills/security-review .gemini/skills/security-review && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "security-review" agent skill from https://github.com/SpecterOps/skills/tree/main/plugins/ops-appsec/skills/security-review into .gemini/skills/security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-review", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install SpecterOps/skills security-reviewInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add SpecterOps/skills --skill security-review -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/SpecterOps/skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/plugins/ops-appsec/skills/security-review .github/skills/security-review && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "security-review" agent skill from https://github.com/SpecterOps/skills/tree/main/plugins/ops-appsec/skills/security-review into .github/skills/security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-review", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add SpecterOps/skills --skill security-review -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install SpecterOps/skills security-review --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/SpecterOps/skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/plugins/ops-appsec/skills/security-review .opencode/skills/security-review && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "security-review" agent skill from https://github.com/SpecterOps/skills/tree/main/plugins/ops-appsec/skills/security-review into .opencode/skills/security-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "security-review", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
security-review- GitHub stars
- 702
- Token cost
- ~556 tokens
- SKILL.md length
- 232 words
- Files
- 4 (incl. assets)
- Skills in repo
- 38
- Repo updated
- First seen
- Licence
- Apache-2.0
At a glance
Perform a security-focused review of current git changes. An agent skill from SpecterOps/skills.
- Works in 6 steps: Determine scope → Run git status for context. → Read full changed files (not only hunks)… → …
- Reviewing staged/unstaged diffs
- SKILL.md covers Input Parsing, Review Workflow, Security Categories and Correctness and Reliability, plus 2 more sections
- Calls git
What it does
Security Review is an agent skill from SpecterOps/skills. Perform a security-focused review of current git changes. Use when reviewing staged/unstaged diffs, checking for vulnerabilities, and deciding merge readiness.
Its SKILL.md is about 560 tokens, which your agent loads only when the skill is triggered. The skill folder holds 5 other files, including assets (for example `agents/openai.yaml`).
It sits in Security, covering Security review. It works with Git. The repository describes itself as: A marketplace for LLM skills. The licence is Apache-2.0.
When your agent uses it
- Reviewing staged/unstaged diffs
- Checking for vulnerabilities
- Deciding merge readiness
Example prompts
- “/security-review”
Workflow steps
6 steps, taken from the first numbered list in SKILL.md.
- Determine scope
- Run git status for context.
- Read full changed files (not only hunks) to catch cross-function issues.
- Analyze findings by categories below.
- Report findings ordered by severity with actionable fixes.
- Provide merge verdict (safe to merge, needs fixes, needs rework).
What it can do on your machine
Read from SKILL.md and the folder at commit e655f93. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
git
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use git, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Security Review loads about 556 tokens when it runs. Until then it costs about 44 tokens; SKILL.md has 232 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from SpecterOps/skills at commit e655f93, republished under its Apache-2.0 licence (© SpecterOps). 232 words, ~556 tokens.
Download SKILL.mdSave it as
.claude/skills/security-review/SKILL.md (or your agent's skills folder). This skill also uses 3 other files; get the full folder from GitHub.- name
- security-review
- description
- Perform a security-focused review of current git changes. Use when reviewing staged/unstaged diffs, checking for vulnerabilities, and deciding merge readiness.
- metadata.author
- GhostWorks
Security Review
Review local git changes with emphasis on exploitability, trust boundaries, and safe-by-default behavior.
Input Parsing
Accept input as: SCOPE
Supported scopes:
all(default): staged and unstaged changesstaged: only staged changesunstaged: only unstaged changes
Examples:
$security-review$security-review staged$security-review unstaged
Review Workflow
- Determine scope:
- staged:
git diff --staged - unstaged:
git diff - all: both
- staged:
- Run
git statusfor context. - Read full changed files (not only hunks) to catch cross-function issues.
- Analyze findings by categories below.
- Report findings ordered by severity with actionable fixes.
- Provide merge verdict (
safe to merge,needs fixes,needs rework).
Security Categories
- Injection risks: SQL/command/LDAP/template/XSS paths.
- Secrets exposure: API keys, credentials, tokens, private keys, connection strings.
- Path/file handling: traversal, unsafe joins, arbitrary read/write.
- Insecure deserialization: unsafe loaders, implicit object decoding.
- Crypto misuse: weak algorithms, static keys/IVs, incorrect modes.
- SSRF/open redirect: unvalidated URLs or callback targets.
- AuthN/AuthZ flaws: missing checks, IDOR, privilege escalation.
- Session/JWT issues: weak secrets, missing expiry/validation, algorithm confusion.
- CORS and headers: overly permissive policies, missing protective headers.
Correctness and Reliability
- Boundary and off-by-one issues.
- Error handling gaps that leak sensitive details.
- Resource lifecycle leaks.
- Concurrency/race condition hazards.
Reporting Format
For each finding include:
severityfile:lineissueimpactrecommended fix
Then include:
- total findings by severity
- overall merge verdict
Quality Rules
- Focus findings first; keep summary brief.
- Avoid speculative claims without code evidence.
- Prefer concrete fix guidance over generic advice.
© SpecterOps, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 3 other files (assets) in plugins/ops-appsec/skills/security-review of SpecterOps/skills.
- SKILL.md
- agents/openai.yaml
- assets/icon.png
- assets/icon.svg
Open the folder on GitHubat commit e655f93
Compare with similar skills
Security Review next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Security Review this skillSpecterOps/skills | 702 | — | ~556 | Automated safety check: Pass | Apache-2.0 | |
| Commit Security Scancodexstar69/bug-hunter | 519 | — | ~629 | Automated safety check: Pass | MIT | |
| Cc Reviewdoccker/cc-use-exp | 1.1k | — | ~541 | Automated safety check: Pass | Custom licence | |
| Security Auditblueberrycongee/termcanvas | 406 | — | ~966 | Automated safety check: Notes | MIT | |
| Security Setupluongnv89/skills | 131 | — | ~4.5k | Automated safety check: Pass | MIT | |
| Security Reviewwaybarrios/opencode-power-pack | 533 | — | ~4.1k | Automated safety check: Pass | MIT |
Similar skills
Cc Review
doccker/cc-use-exp
结构化代码审查工作流，适用于显式 quick/full/security review；不负责普通实现或 bug 修复流程。
Security Audit
blueberrycongee/termcanvas
Security audit skill. An agent skill from blueberrycongee/termcanvas.
Security Setup
luongnv89/skills
Install local-first security hardening: pre-commit secret detection, offline dependency scans, static analysis, reports, and gated free CI.
Security Review
waybarrios/opencode-power-pack
Perform a focused security review of pending git changes to identify high-confidence security vulnerabilities with real exploitation potential.
Security
notque/vexjoy-agent
Security: review git changes for vulnerabilities, threat-model a system's attack surface, audit supply-chain risks.
More from SpecterOps/skills
All 38 skills in this repoCodex Activity Report
SpecterOps/skills
Generate a normalized UTC timeline and evidence-based narrative from Codex activity artifacts.
Com Proxy Triage
SpecterOps/skills
A skill your agent uses when the user wants to triage Windows COM proxy/hijack candidates by capturing HKCU\Software\Classes\CLSID\{...}\InProcServer32 NAME NOT FOUND lookups for a process, mapping…
Cwe Code Review
SpecterOps/skills
Perform CWE-grounded security code reviews and precise weakness mapping using a locally derived MITRE CWE corpus, relationship graphs, mapping notes, detection methods, mitigations, and schema…
Ghostwriter Oplog
SpecterOps/skills
A skill your agent uses for Ghostwriter operation log entries from Codex, including config guidance, quick notes, evidence-backed entries, and guided oplog capture through the Ghostwriter MCP tools.
Nmap Parse
SpecterOps/skills
Parse nmap scan output and generate actionable recon notes. An agent skill from SpecterOps/skills.
Osint Recon
SpecterOps/skills
Perform OSINT and external reconnaissance for approved targets.
Related
Works with
Categories
Questions about Security Review
What does Security Review do?
Perform a security-focused review of current git changes. An agent skill from SpecterOps/skills. Security Review is an agent skill from SpecterOps/skills. Perform a security-focused review of current git changes.
When should I use Security Review?
Security Review fits situations like: reviewing staged/unstaged diffs; checking for vulnerabilities; deciding merge readiness.
How do I install Security Review in Claude Code?
Run `npx skills add SpecterOps/skills --skill security-review -a claude-code`. Or copy the skill folder (plugins/ops-appsec/skills/security-review in SpecterOps/skills) into .claude/skills/security-review in your project. Claude Code loads it when a task matches its description.
How do I install Security Review in Codex?
Run `npx skills add SpecterOps/skills --skill security-review -a codex`. Or copy the skill folder (plugins/ops-appsec/skills/security-review in SpecterOps/skills) into .agents/skills/security-review in your project. Codex loads it when a task matches its description.
Can I use Security Review in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add SpecterOps/skills --skill security-review -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/security-review, .gemini/skills/security-review, .github/skills/security-review and .opencode/skills/security-review in your project.
What does Security Review need to run?
Going by SKILL.md and its folder, Security Review needs the command-line tools its instructions call (git).
Does Security Review access the network?
SKILL.md contains no URLs. Its commands use git, which can reach the network depending on how they are called. This is read from the text; nothing was executed.
Is Security Review safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Security Review use?
Security Review is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Security Review use?
About 556 tokens (SKILL.md is roughly 2.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Security Review?
Skills that share tags, products or a category with Security Review: Commit Security Scan (codexstar69/bug-hunter, 519 stars), Cc Review (doccker/cc-use-exp, 1.1k stars), Security Audit (blueberrycongee/termcanvas, 406 stars) and Security Setup (luongnv89/skills, 131 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Security Review?
SpecterOps (a GitHub organization) maintains it in SpecterOps/skills, which has 702 GitHub stars. The repository holds 38 skills in this directory. The repository was last updated on September 23, 2026.
Source: SpecterOps/skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.