Security Review
trycompai/comp
Check code for the most common, high-risk security vulnerabilities (broken access control, tenant isolation, injection, secrets, SSRF, auth/session, unsafe file handling, mass assignment) before it…
Security review checklist for Convex functions, auth logic, public queries, admin routes, webhooks, uploads, and AI-generated code.
Install Sec Check
$ npx skills add waynesutton/markdown-site --skill sec-check -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install waynesutton/markdown-site sec-check --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/waynesutton/markdown-site.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.claude/sec-check .claude/skills/sec-check && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "sec-check" agent skill from https://github.com/waynesutton/markdown-site/tree/main/.claude/sec-check into .claude/skills/sec-check/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sec-check", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/waynesutton/markdown-site/tree/main/.claude/sec-checkType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add waynesutton/markdown-site --skill sec-check -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install waynesutton/markdown-site sec-check --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/waynesutton/markdown-site.git skills-src && mkdir -p .agents/skills && cp -r skills-src/.claude/sec-check .agents/skills/sec-check && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "sec-check" agent skill from https://github.com/waynesutton/markdown-site/tree/main/.claude/sec-check into .agents/skills/sec-check/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sec-check", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add waynesutton/markdown-site --skill sec-check -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install waynesutton/markdown-site sec-check --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/waynesutton/markdown-site.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/.claude/sec-check .cursor/skills/sec-check && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "sec-check" agent skill from https://github.com/waynesutton/markdown-site/tree/main/.claude/sec-check into .cursor/skills/sec-check/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sec-check", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/waynesutton/markdown-site.git --path .claude/sec-check--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add waynesutton/markdown-site --skill sec-check -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install waynesutton/markdown-site sec-check --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/waynesutton/markdown-site.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/.claude/sec-check .gemini/skills/sec-check && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "sec-check" agent skill from https://github.com/waynesutton/markdown-site/tree/main/.claude/sec-check into .gemini/skills/sec-check/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sec-check", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install waynesutton/markdown-site sec-checkInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add waynesutton/markdown-site --skill sec-check -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/waynesutton/markdown-site.git skills-src && mkdir -p .github/skills && cp -r skills-src/.claude/sec-check .github/skills/sec-check && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "sec-check" agent skill from https://github.com/waynesutton/markdown-site/tree/main/.claude/sec-check into .github/skills/sec-check/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sec-check", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add waynesutton/markdown-site --skill sec-check -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install waynesutton/markdown-site sec-check --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/waynesutton/markdown-site.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/.claude/sec-check .opencode/skills/sec-check && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "sec-check" agent skill from https://github.com/waynesutton/markdown-site/tree/main/.claude/sec-check into .opencode/skills/sec-check/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "sec-check", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
sec-check- GitHub stars
- 628
- Token cost
- ~753 tokens
- SKILL.md length
- 405 words
- Files
- 1
- Skills in repo
- 17
- Repo updated
- First seen
- Licence
- MIT
At a glance
Security review checklist for Convex functions, auth logic, public queries, admin routes, webhooks, uploads, and AI-generated code.
- Reviewing code that touches user data
- SKILL.md covers When to use it, Auth and ownership checks, Data exposure rules and Sensitive integrations, plus 2 more sections
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
- Tasks that involve Webhooks
What it does
Sec Check is an agent skill from waynesutton/markdown-site. Security review checklist for Convex functions, auth logic, public queries, admin routes, webhooks, uploads, and AI-generated code. Use when reviewing code that touches user data, PII, or access control.
Its SKILL.md is about 750 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Backend & APIs, covering Webhooks, Security review and Authorization and RBAC. The repository describes itself as: An open-source publishing framework built for AI agents and developers to ship websites, docs, or blogs. Write markdown, sync from the terminal. Your content is instantly… The licence is MIT.
When your agent uses it
- Reviewing code that touches user data
- Tasks that involve Webhooks
- Tasks that involve Security review
Example prompts
- “/sec-check”
What it can do on your machine
Read from SKILL.md and the folder at commit 3872c59. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Sec Check loads about 753 tokens when it runs. Until then it costs about 53 tokens; SKILL.md has 405 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from waynesutton/markdown-site at commit 3872c59, republished under its MIT licence (© waynesutton). 405 words, ~753 tokens.
Download SKILL.mdSave it as
.claude/skills/sec-check/SKILL.md (or your agent's skills folder).- name
- sec-check
- description
- Security review checklist for Convex functions, auth logic, public queries, admin routes, webhooks, uploads, and AI-generated code. Use when reviewing code that touches user data, PII, or access control.
Security Review Skill
Use this skill when reviewing Convex functions, auth logic, public query shapes, admin routes, webhooks, uploads, or any AI generated code that touches user data.
When to use it
Reach for this skill when:
- a mutation writes user or admin data
- a public query returns package or user data
- an internal function should be separated from a public wrapper
- a form collects names, emails, or other contact info
- a webhook, upload, or API key flow is added
- AI generated code needs a security pass before shipping
Auth and ownership checks
- Call
ctx.auth.getUserIdentity()before authenticated writes. - Never trust client supplied user ids for ownership.
- Prefer indexed ownership checks over fetch then compare patterns.
- Use
internalQuery,internalMutation, andinternalActionfor sensitive backend work. - Keep public wrappers thin. Do auth and access checks there, then call internal functions.
- Return generic
Not foundstyle errors when you should not reveal existence.
Data exposure rules
- Public queries should return public safe shapes only.
- Strip PII like email, name, Discord handle, internal notes, AI review details, or admin metadata unless the caller is allowed to see them.
- Add explicit return validators on public functions so the response shape stays tight.
- Mutations should return minimal data, usually ids or
null, not the submitted object. - Treat everything returned by a query as visible in browser DevTools and WebSocket traffic.
Show full SKILL.md (181 more words)Show less
Sensitive integrations
- Keep secrets in server side environment variables only.
- Validate webhook signatures before processing.
- Restrict CORS for sensitive endpoints.
- Validate upload types and file sizes server side.
- Do not send user PII into AI prompts when it is not required for the task.
- Use simple actor labels like
AIorSystem, not fake email addresses, for automated actions.
AI generated code checks
- Watch for missing
returnsvalidators. - Watch for public
queryormutationusage whereinternal*should be used. - Watch for
ctx.db.get()plus client supplied ids in ownership checks. - Watch for full objects returned from public queries or mutations.
- Watch for vague or over detailed error messages that leak internal state.
Verification checklist
- Open the browser network panel and inspect WebSocket or XHR responses for sensitive fields.
- Hard refresh after deploying security changes so cached subscriptions do not fool the test.
- Verify public queries exclude PII and internal metadata.
- Verify admin queries require auth and admin checks before returning full data.
- Verify mutations return minimal data.
- Verify any new action or integration logs full errors only on the server side.
© waynesutton, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in .claude/sec-check of waynesutton/markdown-site.
Open the folder on GitHubat commit 3872c59
Compare with similar skills
Sec Check next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Sec Check this skillwaynesutton/markdown-site | 628 | — | ~753 | Automated safety check: Pass | MIT | |
| Security Reviewtrycompai/comp | 2k | — | ~853 | Automated safety check: Pass | AGPL-3.0 | |
| Security ConvexIgorWarzocha/Opencode-Workflows | 122 | — | ~3.1k | Automated safety check: Pass | None | |
| Security Threat Modelmajiayu000/spellbook | 286 | — | ~561 | Automated safety check: Pass | MIT | |
| Security Hardeningchmonitor/chmonitor | 298 | — | ~440 | Automated safety check: Pass | GPL-3.0 | |
| Django Access Reviewgetsentry/skills | 1k | 3 repos | ~2.6k | Automated safety check: Notes | Apache-2.0 |
Similar skills
Security Convex
IgorWarzocha/Opencode-Workflows
Review Convex security audit patterns for authentication and authorization.
Security Threat Model
majiayu000/spellbook
Threat-model product features, APIs, data flows, secrets, permissions, supply-chain changes, auth boundaries, and risky code paths before or during implementation.
Security Hardening
chmonitor/chmonitor
RBAC configuration, row policies, quotas, network security, audit logging, and access control best practices.
- Official
Django Access Review
getsentry/skills
Django access control and IDOR security review. An agent skill from getsentry/skills.
Cb Security Hardening
BlkLeg/CircuitBreaker
Enforces Circuit Breaker security hardening conventions across backend, frontend, Docker, and nginx.
More from waynesutton/markdown-site
All 17 skills in this repoConvex Self Hosting
waynesutton/markdown-site
Integrate Convex static self hosting into existing apps using the latest upstream instructions from get-convex/self-hosting every time.
Robel Auth
waynesutton/markdown-site
Integrate and maintain Robelest Convex Auth in apps by always checking upstream before implementation.
Migration Helper
waynesutton/markdown-site
Plan and execute Convex schema migrations safely, including adding fields, creating tables, and data transformations.
Convex Return Validators
waynesutton/markdown-site
Guide for when to use and when not to use return validators in Convex functions.
Convex Doctor
waynesutton/markdown-site
Run convex-doctor static analysis, interpret findings, and fix issues across security, performance, correctness, schema, and architecture categories.
Convex Quickstart
waynesutton/markdown-site
Initialize a new Convex project from scratch or add Convex to an existing app.
Related
Categories
Questions about Sec Check
What does Sec Check do?
Security review checklist for Convex functions, auth logic, public queries, admin routes, webhooks, uploads, and AI-generated code. Sec Check is an agent skill from waynesutton/markdown-site. Security review checklist for Convex functions, auth logic, public queries, admin routes, webhooks, uploads, and AI-generated code.
When should I use Sec Check?
Sec Check fits situations like: reviewing code that touches user data; tasks that involve Webhooks; tasks that involve Security review.
How do I install Sec Check in Claude Code?
Run `npx skills add waynesutton/markdown-site --skill sec-check -a claude-code`. Or copy the skill folder (.claude/sec-check in waynesutton/markdown-site) into .claude/skills/sec-check in your project. Claude Code loads it when a task matches its description.
How do I install Sec Check in Codex?
Run `npx skills add waynesutton/markdown-site --skill sec-check -a codex`. Or copy the skill folder (.claude/sec-check in waynesutton/markdown-site) into .agents/skills/sec-check in your project. Codex loads it when a task matches its description.
Can I use Sec Check in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add waynesutton/markdown-site --skill sec-check -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/sec-check, .gemini/skills/sec-check, .github/skills/sec-check and .opencode/skills/sec-check in your project.
What does Sec Check need to run?
SKILL.md names no scripts, command-line tools or credentials: Sec Check is instructions for the agent only.
Does Sec Check access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Sec Check safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Sec Check use?
Sec Check is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Sec Check use?
About 753 tokens (SKILL.md is roughly 3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Sec Check?
Skills that share tags, products or a category with Sec Check: Security Review (trycompai/comp, 2k stars), Security Convex (IgorWarzocha/Opencode-Workflows, 122 stars), Security Threat Model (majiayu000/spellbook, 286 stars) and Security Hardening (chmonitor/chmonitor, 298 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Sec Check?
waynesutton (a GitHub user) maintains it in waynesutton/markdown-site, which has 628 GitHub stars. The repository holds 17 skills in this directory. The repository was last updated on May 20, 2026.
Source: waynesutton/markdown-site on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.