New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Security Review

by trycompai in trycompai/comp

Check code for the most common, high-risk security vulnerabilities (broken access control, tenant isolation, injection, secrets, SSRF, auth/session, unsafe file handling, mass assignment) before it…

AGPL-3.0Auto-check passedSecurity

Install Security Review

skills CLI
$ npx skills add trycompai/comp --skill security-review -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install trycompai/comp security-review --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/trycompai/comp.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.claude/skills/security-review .claude/skills/security-review && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
security-review
GitHub stars
2k
Token cost
~853 tokens
SKILL.md length
355 words
Files
1
Skills in repo
31
Repo updated
First seen
Licence
AGPL-3.0

At a glance

Check code for the most common, high-risk security vulnerabilities (broken access control, tenant isolation, injection, secrets, SSRF, auth/session, unsafe file handling, mass assignment) before it…

  • Works in 4 steps: Scope → Review → Verify (no false positives) → …
  • Tasks that involve Web application vulnerabilities
  • SKILL.md covers 1. Scope, 2. Review, 3. Verify (no false positives) and 4. Fix & report
  • Calls git and bunx

What it does

Security Review is an agent skill from trycompai/comp. Check code for the most common, high-risk security vulnerabilities (broken access control, tenant isolation, injection, secrets, SSRF, auth/session, unsafe file handling, mass assignment) before it ships. Use after editing any API controller, guard, or auth code (apps/api/src/auth/), a Prisma schema/query, a file-upload/webhook handler, or before committing/pushing security-sensitive changes.

Its SKILL.md is about 850 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Web application vulnerabilities, File uploads and storage and Security review. It works with Prisma. The repository describes itself as: AI Native platform to get companies compliant - Vanta & Drata Alternative. The licence is AGPL-3.0.

When your agent uses it

  • Tasks that involve Web application vulnerabilities
  • Tasks that involve File uploads and storage
  • Tasks that involve Security review

Example prompts

  • “/security-review”

Workflow steps

4 steps, taken from the step headings in SKILL.md.

  1. Scope
  2. Review
  3. Verify (no false positives)
  4. Fix & report

What it can do on your machine

Read from SKILL.md and the folder at commit 0117612. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • git
    • bunx

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use git and bunx, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Security Review loads about 853 tokens when it runs. Until then it costs about 103 tokens; SKILL.md has 355 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~103
When it runs · the whole SKILL.md, loaded when a task matches
~853

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from trycompai/comp at commit 0117612, republished under its AGPL-3.0 licence (© trycompai). 355 words, ~853 tokens.

Download SKILL.mdSave it as .claude/skills/security-review/SKILL.md (or your agent's skills folder).
name
security-review
description
Check code for the most common, high-risk security vulnerabilities (broken access control, tenant isolation, injection, secrets, SSRF, auth/session, unsafe file handling, mass assignment) before it ships. Use after editing any API controller, guard, or auth code (apps/api/src/auth/**), a Prisma schema/query, a file-upload/webhook handler, or before committing/pushing security-sensitive changes.

Review code for high-risk security vulnerabilities and fix confirmed high-severity issues immediately. Complements CI (CodeQL/Dependabot/SBOM) by catching logic/design flaws those miss — do not re-flag dependency CVEs or generic lint.

1. Scope

  • If $ARGUMENTS names files/dirs, review those.
  • Otherwise review the current change set: git diff --name-only origin/main...HEAD (fall back to git diff --name-only for uncommitted work). Skip generated files, lockfiles, and *.spec.ts (unless the change is in a spec).

Review whenever the change touches a trust boundary or a resource — judge by behavior, not path. That includes: any controller or service (services are where IDOR, tenant-scoping, and mass-assignment bugs actually live), Next.js route handlers (app/api/**, route.ts), Trigger.dev jobs (apps/api/src/trigger/** — SSRF, elevated context), guards/auth (apps/api/src/auth/**, packages/auth/**), any Prisma query (especially lookups/updates/deletes by a client-supplied id → IDOR), middleware, file upload/storage, webhooks, outbound requests to a dynamic URL, crypto/token handling, and any frontend that renders user-supplied HTML or builds redirects from input.

Only if the change is genuinely non-security (pure presentation, types, copy, config with no secrets) — say so and stop, don't invent findings.

2. Review

Dispatch the security-reviewer agent on the scoped files. For a broad review (a full PR / many files), fan out parallel security-reviewer agents by dimension group so coverage is thorough:

  • Access control & tenancy — guards, @RequirePermission, API-key/service-token scope enforcement, authz-vs-attribution, IDOR, organizationId scoping.
  • Injection, XSS & mass assignment — raw Prisma/SQL, command/path injection, dangerouslySetInnerHTML/unsanitized HTML, ...dto spread into create/update.
  • Secrets, SSRF, auth/session & file handling — hardcoded/logged secrets, outbound fetch to user URLs, session/cookie/attribution boundaries, S3/upload safety, DoS, info disclosure.

The agent's full checklist lives in .claude/agents/security-reviewer.md.

Show full SKILL.md (101 more words)Show less

3. Verify (no false positives)

For each P1/P2 finding, adversarially verify before acting: dispatch one security-reviewer (or read the code yourself) prompted to refute it — trace the guard→controller→service→DB path. Drop anything that can't be confirmed. Attribution-only use of a resolved actor, org-scoped queries, and parameterized Prisma are NOT findings.

4. Fix & report

  • Fix confirmed P1/P2 issues immediately (mirror the surrounding code; add a regression test for auth/attribution changes).
  • Report P3s and anything needing a product decision, with severity · file:line · exploit/impact · fix.
  • Run bunx turbo run typecheck --filter=@trycompai/api --filter=@trycompai/app after fixes.
  • End with a one-line verdict: clean, or the highest-priority action remaining.

© trycompai, AGPL-3.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .claude/skills/security-review of trycompai/comp.

Open the folder on GitHubat commit 0117612

Compare with similar skills

Security Review next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Security Review compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Security Review this skilltrycompai/comp2k—~853Automated safety check: PassAGPL-3.0
Security Reviewlangfuse/langfuse36k—~1.4kAutomated safety check: PassCustom licence
Django Access Reviewgetsentry/skills1k3 repos~2.6kAutomated safety check: NotesApache-2.0
Security ConvexIgorWarzocha/Opencode-Workflows122—~3.1kAutomated safety check: PassNone
Security Reviewgetsentry/warden414—~1.8kAutomated safety check: PassCustom licence
Security Auditjellydn/my-ai-tools123—~2.9kAutomated safety check: NotesMIT

Similar skills

  • Security Review

    langfuse/langfuse

    Review Langfuse changes for SSRF, tenant isolation, secret handling, unsafe redirects or uploads, RBAC drift, and client telemetry privacy.

    36k GitHub stars~1.4k tokensUpdated today
    SecurityAuto-check passed

  • Django Access Review

    getsentry/skills

    Official

    Django access control and IDOR security review. An agent skill from getsentry/skills.

    1k GitHub starsUsed in 3 repos~2.6k tokens
    Backend & APIsAuto-check: notes

  • Security Convex

    IgorWarzocha/Opencode-Workflows

    Review Convex security audit patterns for authentication and authorization.

    122 GitHub stars~3.1k tokensUpdated 8 mo ago
    SecurityAuto-check passed

  • Security Review

    getsentry/warden

    Official

    Finds exploitable application security vulnerabilities in code changes.

    414 GitHub stars~1.8k tokensUpdated 7 days ago
    SecurityAuto-check passed

  • Security Audit

    jellydn/my-ai-tools

    A skill your agent uses when reviewing code for security vulnerabilities, hardening an application, or deriving security requirements from OWASP/ASVS guidance.

    123 GitHub stars~2.9k tokensUpdated today
    SecurityAuto-check: notes

  • Openfdd Mt Security

    bbartling/open-fdd

    Multi-tenant authz, pre-auth disclosure hardening, and Kali disposition.

    172 GitHub stars~2.2k tokensUpdated today
    Backend & APIsAuto-check passed

More from trycompai/comp

All 31 skills in this repo

  • API Endpoint Contract

    trycompai/comp

    The contract every new or modified API endpoint must follow so it is correct for the public OpenAPI spec, the MCP server (npm @trycompai/mcp-server), the ValidationPipe, and the docs.

    2k GitHub stars~2.7k tokensUpdated today
    Auto-check passed

  • Check Results Service

    trycompai/comp

    How to reuse ANY integration check's results in a feature via the universal CheckResultsService (apps/api integration-platform).

    2k GitHub stars~2.1k tokensUpdated today
    Auto-check passed

  • Data

    trycompai/comp

    A skill your agent uses when implementing data fetching, API calls, server/client components, or SWR hooks

    2k GitHub stars~955 tokensUpdated today
    Auto-check passed

  • Diagnose Generation Failure

    trycompai/comp

    A skill your agent uses when SDK generation failed or seeing errors.

    2k GitHub stars~938 tokensUpdated today
    Auto-check passed

  • Forms

    trycompai/comp

    A skill your agent uses when building forms - covers React Hook Form, Zod validation, and form patterns

    2k GitHub stars~1k tokensUpdated today
    Auto-check passed

  • Code

    trycompai/comp

    A skill your agent uses when writing TypeScript/React code - covers type safety, component patterns, and file organization

    2k GitHub stars~909 tokensUpdated today
    Auto-check: warnings

Works with

Categories

Questions about Security Review

What does Security Review do?

Check code for the most common, high-risk security vulnerabilities (broken access control, tenant isolation, injection, secrets, SSRF, auth/session, unsafe file handling, mass assignment) before it…. Security Review is an agent skill from trycompai/comp. Check code for the most common, high-risk security vulnerabilities (broken access control, tenant isolation, injection, secrets, SSRF, auth/session, unsafe file handling, mass assignment) before it ships.

When should I use Security Review?

Security Review fits situations like: tasks that involve Web application vulnerabilities; tasks that involve File uploads and storage; tasks that involve Security review.

How do I install Security Review in Claude Code?

Run `npx skills add trycompai/comp --skill security-review -a claude-code`. Or copy the skill folder (.claude/skills/security-review in trycompai/comp) into .claude/skills/security-review in your project. Claude Code loads it when a task matches its description.

How do I install Security Review in Codex?

Run `npx skills add trycompai/comp --skill security-review -a codex`. Or copy the skill folder (.claude/skills/security-review in trycompai/comp) into .agents/skills/security-review in your project. Codex loads it when a task matches its description.

Can I use Security Review in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add trycompai/comp --skill security-review -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/security-review, .gemini/skills/security-review, .github/skills/security-review and .opencode/skills/security-review in your project.

What does Security Review need to run?

Going by SKILL.md and its folder, Security Review needs the command-line tools its instructions call (git and bunx).

Does Security Review access the network?

SKILL.md contains no URLs. Its commands use git, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Security Review safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Security Review use?

Security Review is published under the AGPL-3.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Security Review use?

About 853 tokens (SKILL.md is roughly 3.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Security Review?

Skills that share tags, products or a category with Security Review: Security Review (langfuse/langfuse, 36k stars), Django Access Review (getsentry/skills, 1k stars), Security Convex (IgorWarzocha/Opencode-Workflows, 122 stars) and Security Review (getsentry/warden, 414 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Security Review?

trycompai (a GitHub organization) maintains it in trycompai/comp, which has 2,018 GitHub stars. The repository holds 31 skills in this directory. The repository was last updated on October 7, 2026.

Source: trycompai/comp on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.