This entry duplicates agent-security-review, which is the one we list in search.

agent-security-review

Lightweight security review pass for PRs — secrets, auth/access, dependencies, web/data safety, config.

IndexedMIT

Install

Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.

npx agentmarket install skill/csackrider-agent-security-review

Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.

Get the weekly diff

The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.

About

Lightweight security review pass for PRs — secrets, auth/access, dependencies, web/data safety, config. Used by the /review orchestrator for the Security dimension.

Use cases: data, security, agent-building

Reviews

Write a review

No reviews yet. Installed it? Reviews come from verified installers only. How reviews work

Permissions: not checked yet.

What's inside

Skill name: agent-security-review
Description: Lightweight security review pass for PRs — secrets, auth/access, dependencies, web/data safety, config. Used by the /review orchestrator for the Security dimension.
License: MIT
Instructions: 29 lines in SKILL.md · view on GitHub

Files (1)

SKILL.md

SKILL.md (first lines)

# Security review (AIDLC Review — Security)

You are the **security reviewer** for a single PR or change set. You do **not** replace a dedicated security team or pentest — you catch **obvious** issues and misconfigurations.

**Compose with:** **`backend-saas`** for API/auth patterns and **`architecture`** for boundaries and deployment assumptions.

## Inputs

- PR diff and touched files
- `tech-spec.md` (approved) — authorization model and public vs private surfaces
- Stack context from the repo (e.g. .NET, Node, Docker)

## Checklist

| Area | What to check |
|------|----------------|
| **Secrets & credentials** | No committed keys/tokens/PEM/live connection strings; patterns like `sk-`, AWS keys; `.env` misuse. |
| **Auth & access** | Authorization vs Tech Spec; missing `[Authorize]` / policy; **IDOR** risks; intentional public endpoints. |
| **Dependencies** | **npm** lockfile with package changes; avoid careless `latest`; **NuGet**; **Docker** `FROM` pinning. |
| **Web & data** | Unsafe HTML, parameterization, CSRF where applicable. |
| **Config & debug** | Debug in prod, default creds. |

## Output

- Findings with **blocking** vs **advisory** labels and file references.
- For docs-only PRs, state **N/A** briefly.
- Feed the parent **`/review`** orchestrator so it can post `### AIDLC Review — Security` on the PR and mirror in `feature/<slug>/review-report.md`.

From csackrider/AI-DLC, MIT.

Signals

Stars: 0
Forks: 0
Open issues: 0
Last commit (this folder): Apr 13, 2026 (6 months ago)

From GitHub (fetched Oct 24, 2026).

Details

License: MIT
Repository: github.com/csackrider/AI-DLC
First seen: Oct 24, 2026
Last checked: Oct 24, 2026
Source: GitHub github-graphql

Same skill elsewhere

Copies of this SKILL.md published by others; search shows only one of them.