security-review

Files (2)

• SKILL.md
• random-file.sh · scripts/

SKILL.md (first lines)

# Security review

## Getting started

Pick a random starting point by running the bundled script. Prefix `scripts/random-file.sh` with this skill's base directory, the absolute path stated when the skill loads:

```bash
bash /path/to/skill/scripts/random-file.sh
```

Run it from the project root: the script samples whatever directory it runs in, and `scripts/` belongs to this skill rather than the project.

The random entry point is intentional: it forces exploration of parts of the codebase that might otherwise be overlooked. The idea is to run this skill multiple times over the life of a project, each time pulling one thread from a different starting point.

Read the file the script returned. From there, follow one promising path -- a single thread of connections (imports, callers, callees, data flow) that looks like it could harbor a security issue. Go deep on that one path rather than trying to survey everything.

## Reporting

Report exactly one finding -- the single most significant security issue you discovered along the path. Not two, not a list, just one. If nothing concerning was found, say so -- that's a valid outcome. Resist the temptation to pad the report with minor observations or informational notes.

1. **Starting point**: which file the review began from
2. **Path followed**: the chain of files you traced and why you chose that direction
3. **Finding**: severity, file and line number, description, and suggested fix

From maragudk/fabrik, MIT.

More from maragudk/fabrik