Security Review
github/awesome-copilot
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching…
Scans a repository's source for security vulnerabilities with the supercov CLI, pointing to the line of each finding and mapping it to CWE classes.
Install Supercov Security
$ npx skills add supercorp-ai/supercov --skill supercov-security -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install supercorp-ai/supercov supercov-security --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/supercorp-ai/supercov.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/supercov/skills/supercov-security .claude/skills/supercov-security && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "supercov-security" agent skill from https://github.com/supercorp-ai/supercov/tree/main/plugins/supercov/skills/supercov-security into .claude/skills/supercov-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "supercov-security", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/supercorp-ai/supercov/tree/main/plugins/supercov/skills/supercov-securityType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add supercorp-ai/supercov --skill supercov-security -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install supercorp-ai/supercov supercov-security --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/supercorp-ai/supercov.git skills-src && mkdir -p .agents/skills && cp -r skills-src/plugins/supercov/skills/supercov-security .agents/skills/supercov-security && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "supercov-security" agent skill from https://github.com/supercorp-ai/supercov/tree/main/plugins/supercov/skills/supercov-security into .agents/skills/supercov-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "supercov-security", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add supercorp-ai/supercov --skill supercov-security -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install supercorp-ai/supercov supercov-security --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/supercorp-ai/supercov.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/plugins/supercov/skills/supercov-security .cursor/skills/supercov-security && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "supercov-security" agent skill from https://github.com/supercorp-ai/supercov/tree/main/plugins/supercov/skills/supercov-security into .cursor/skills/supercov-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "supercov-security", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/supercorp-ai/supercov.git --path plugins/supercov/skills/supercov-security--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add supercorp-ai/supercov --skill supercov-security -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install supercorp-ai/supercov supercov-security --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/supercorp-ai/supercov.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/plugins/supercov/skills/supercov-security .gemini/skills/supercov-security && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "supercov-security" agent skill from https://github.com/supercorp-ai/supercov/tree/main/plugins/supercov/skills/supercov-security into .gemini/skills/supercov-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "supercov-security", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install supercorp-ai/supercov supercov-securityInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add supercorp-ai/supercov --skill supercov-security -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/supercorp-ai/supercov.git skills-src && mkdir -p .github/skills && cp -r skills-src/plugins/supercov/skills/supercov-security .github/skills/supercov-security && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "supercov-security" agent skill from https://github.com/supercorp-ai/supercov/tree/main/plugins/supercov/skills/supercov-security into .github/skills/supercov-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "supercov-security", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add supercorp-ai/supercov --skill supercov-security -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install supercorp-ai/supercov supercov-security --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/supercorp-ai/supercov.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/plugins/supercov/skills/supercov-security .opencode/skills/supercov-security && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "supercov-security" agent skill from https://github.com/supercorp-ai/supercov/tree/main/plugins/supercov/skills/supercov-security into .opencode/skills/supercov-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "supercov-security", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
supercov-security- GitHub stars
- 151
- Used in
- 1 other repo
- Token cost
- ~236 tokens
- SKILL.md length
- 100 words
- Files
- 1
- Skills in repo
- 2
- Repo updated
- First seen
- Licence
- MIT
At a glance
Scans a repository's source for security vulnerabilities with the supercov CLI, pointing to the line of each finding and mapping it to CWE classes.
- The user asks for a security scan
- Calls npx; needs TYPESAFE_API_KEY
- Whether code is secure
- Find vulnerabilities
What it does
Supercov Security is an agent skill from supercorp-ai/supercov. Scans a repository's source for security vulnerabilities with the supercov CLI, pointing to the line of each finding and mapping it to CWE classes. Use when the user asks for a security scan or audit, whether code is secure, or to find vulnerabilities, injection, hardcoded secrets or other insecure code.
Its SKILL.md is about 240 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Testing & QA, covering Secrets management, Security review and Test coverage. It works with JavaScript, Python, Ruby and Rust. The repository describes itself as: Coverage, security and code quality for coding agents. The licence is MIT.
When your agent uses it
- The user asks for a security scan
- Whether code is secure
- Find vulnerabilities
- Hardcoded secrets
Example prompts
- “Use the supercov-security skill to scan a repository's source for security vulnerabilities with the supercov CLI, pointing to the line of each…”
- “/supercov-security”
Requirements
- Node.js
- A credential in TYPESAFE_API_KEY
What it can do on your machine
Read from SKILL.md and the folder at commit b346ffd. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
npx
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use npx, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names these keys or tokens, usually read from environment variables:
TYPESAFE_API_KEY
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Supercov Security loads about 236 tokens when it runs. Until then it costs about 81 tokens; SKILL.md has 100 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from supercorp-ai/supercov at commit b346ffd, republished under its MIT licence (© supercorp-ai). 100 words, ~236 tokens.
Download SKILL.mdSave it as
.claude/skills/supercov-security/SKILL.md (or your agent's skills folder).- name
- supercov-security
- description
- Scans a repository's source for security vulnerabilities with the supercov CLI, pointing to the line of each finding and mapping it to CWE classes. Use when the user asks for a security scan or audit, whether code is secure, or to find vulnerabilities, injection, hardcoded secrets or other insecure code.
- license
- MIT
Supercov security
Run npx supercov security for the whole repository, or npx supercov security patch for what a change introduced. It checks every source file for twelve named risks and points to the line. npx supercov docs security prints the guide for the installed version.
It sends source files to TypeSafe using the TYPESAFE_API_KEY environment variable. A user who set the key has opted in, so run it without asking again. If the key is missing the command says so: tell the user how to set it, then review the code by hand and say Supercov did not check it.
© supercorp-ai, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in plugins/supercov/skills/supercov-security of supercorp-ai/supercov.
Open the folder on GitHubat commit b346ffd
Used in 1 other repository
We found 1 copy of this SKILL.md (exact, near-identical or edited) in other folders, from 1 other GitHub owner. This page covers the copy in supercorp-ai/supercov, which our catalogue first saw on October 7, 2026.
Compare with similar skills
Supercov Security next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Supercov Security this skillsupercorp-ai/supercov | 151 | 1 repos | ~236 | Automated safety check: Pass | MIT | |
| Security Reviewgithub/awesome-copilot | 40k | 1 repos | ~2.3k | Automated safety check: Notes | MIT | |
| Polyglot Test Agentboshi-xixixi/TraeSkill | 275 | — | ~1.7k | Automated safety check: Pass | MIT | |
| Git HooksProrise-cool/Claude-Code-Multi-Agent | 305 | — | ~3.6k | Automated safety check: Notes | None | |
| Asw Programmingwjgoarxiv/antigravity-swarm | 166 | — | ~3k | Automated safety check: Pass | MIT | |
| Mutation Testingsecondsky/claude-skills | 227 | — | ~1.4k | Automated safety check: Notes | MIT |
Similar skills
- Official
Polyglot Test Agent
boshi-xixixi/TraeSkill
Generates comprehensive, workable unit tests for any programming language using a multi-agent pipeline.
Git Hooks
Prorise-cool/Claude-Code-Multi-Agent
Central authority on git hook implementations, modern best practices, and tooling for .NET/C, JavaScript/TypeScript, Python, and polyglot repositories.
Asw Programming
wjgoarxiv/antigravity-swarm
Strict Antigravity implementation discipline for Python, TypeScript, JavaScript, Go, and Rust work.
Mutation Testing
secondsky/claude-skills
Validate test effectiveness with mutation testing using Stryker (TypeScript/JavaScript with Vitest or bun test via @hughescr/stryker-bun-runner) and mutmut (Python).
Code Review Checklist
shareAI-lab/learn-claude-code
Reviews code against a five-part checklist covering security, correctness, performance, maintainability and testing, and reports findings in a fixed format.
More from supercorp-ai/supercov
Supercov
supercorp-ai/supercov
Measures test coverage and code quality in a repository with the supercov CLI, and turns what it finds into small, focused tests or fixes.
Related
Works with
Categories
Questions about Supercov Security
What does Supercov Security do?
Scans a repository's source for security vulnerabilities with the supercov CLI, pointing to the line of each finding and mapping it to CWE classes. Supercov Security is an agent skill from supercorp-ai/supercov. Scans a repository's source for security vulnerabilities with the supercov CLI, pointing to the line of each finding and mapping it to CWE classes.
When should I use Supercov Security?
Supercov Security fits situations like: the user asks for a security scan; whether code is secure; find vulnerabilities; hardcoded secrets.
How do I install Supercov Security in Claude Code?
Run `npx skills add supercorp-ai/supercov --skill supercov-security -a claude-code`. Or copy the skill folder (plugins/supercov/skills/supercov-security in supercorp-ai/supercov) into .claude/skills/supercov-security in your project. Claude Code loads it when a task matches its description.
How do I install Supercov Security in Codex?
Run `npx skills add supercorp-ai/supercov --skill supercov-security -a codex`. Or copy the skill folder (plugins/supercov/skills/supercov-security in supercorp-ai/supercov) into .agents/skills/supercov-security in your project. Codex loads it when a task matches its description.
Can I use Supercov Security in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add supercorp-ai/supercov --skill supercov-security -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/supercov-security, .gemini/skills/supercov-security, .github/skills/supercov-security and .opencode/skills/supercov-security in your project.
What does Supercov Security need to run?
Going by SKILL.md and its folder, Supercov Security needs the command-line tools its instructions call (npx) and credentials named TYPESAFE_API_KEY. Our summary lists: Node.js; A credential in TYPESAFE_API_KEY.
Does Supercov Security access the network?
SKILL.md contains no URLs. Its commands use npx, which can reach the network depending on how they are called. This is read from the text; nothing was executed.
Is Supercov Security safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Supercov Security use?
Supercov Security is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Supercov Security use?
About 236 tokens (SKILL.md is roughly 944 characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Supercov Security?
Skills that share tags, products or a category with Supercov Security: Security Review (github/awesome-copilot, 40k stars), Polyglot Test Agent (boshi-xixixi/TraeSkill, 275 stars), Git Hooks (Prorise-cool/Claude-Code-Multi-Agent, 305 stars) and Asw Programming (wjgoarxiv/antigravity-swarm, 166 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Supercov Security?
supercorp-ai (a GitHub organization) maintains it in supercorp-ai/supercov, which has 151 GitHub stars. The repository holds 2 skills in this directory. The repository was last updated on October 8, 2026.
Source: supercorp-ai/supercov on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.