AI Plugin Index
security-review
Skill by codewhale-hq · updated · ★ 41k
Review a change, module, or surface for exploitable defects — trust boundaries, authn/authz, injection, secret exposure, filesystem and network reach, dependency risk. Use when the user asks for a security review, audit, or vulnerability check of concrete code. Not for general code review, lint, or compliance paperwork. security-review is published by codewhale-hq on GitHub.
Last commit in the past day
MIT: permissive, fine for commercial use
Clear description, installs from GitHub, 41,112 stars, original repository
Not checked yet. What we check
Install security-review
Built from the published package, never by AIgit clone --depth 1 https://github.com/codewhale-hq/Codewhale /tmp/Codewhale && mkdir -p ~/.claude/skills && cp -r /tmp/Codewhale/crates/tui/assets/skills/security-review ~/.claude/skills/security-reviewRun in your terminal. Claude Code loads skills from ~/.claude/skills automatically.
git clone --depth 1 https://github.com/codewhale-hq/Codewhale /tmp/Codewhale && mkdir -p ~/.gemini/antigravity-cli/skills && cp -r /tmp/Codewhale/crates/tui/assets/skills/security-review ~/.gemini/antigravity-cli/skills/security-reviewAntigravity CLI loads skills from ~/.gemini/antigravity-cli/skills, or .agents/skills for one project.
Skills can run scripts on your machine. Some need an API key: check the README.
Weekly newsletter
Like security-review? Get the best new skills every week
The best new tools, security warnings before you install something risky, and one practical tip. Free, three minute read.
Alternatives to security-review
All alternatives →
Build Slack apps using the Bolt framework across Python, JavaScript, and Java. Covers Block Kit for rich UIs, interactive components, slash commands, event handling, OAuth installation flows, and Workflow Builder integration.
Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access, and builds SIEM detection rules from the event patterns. Use when investigating a suspected cluster compromise, reconstructing what an attacker did through the API server, or writing Kubernetes-specific detection content. Keywords: audit policy, audit log, kube-apiserver, exec into pod, RBAC change, anonymous access, detection rules. Do not use for syscall-level detection inside a running container - use detecting-container-runtime-threats-with-falco. '
Review a verdaccio diff, branch, or pull request against the repository review guide (security first, then npm-client compatibility, performance, product fit, maintainability), verify each finding against the code, and report actionable issues. Use for code reviews and for reviewing your own changes before or during a PR workflow.
Review multiplayer authority, RPCs, sessions, authorization, replication, inventory, economy, purchases, retries, and replay. Use when server or backend state is the security boundary.
CVE lookup and applicability assessment domain card. Use after reconnaissance has identified products, versions, services, or fingerprints and red-team mode needs evidence-based CVE matching before deeper testing.
Reviews MSBuild code changes using a 24-dimension methodology. Activates for code review, PR review, pull request analysis, design review, architecture review, code quality assessment, or style check of MSBuild code. Covers backwards compatibility, ChangeWave discipline, performance, allocation awareness, test coverage, error message quality, logging, string comparison, API surface, target authoring, cross-platform correctness, code simplification, concurrency, naming, SDK integration, evaluation model integrity, correctness, dependency management, security, and build infrastructure.
security-review: common questions
How do I install security-review?
Run the command above to copy the skill into ~/.claude/skills/. Claude Code picks it up automatically.
Is security-review free?
The code is published under the MIT licence. The service it connects to may have its own pricing.
Is security-review safe to use?
It scores 89 of 100. Grades: maintenance A, licence A, quality A. The security check has not run for it yet. Review the code before you install. How grades work.
What are alternatives to security-review?
Similar skills: slack-bot-builder, analyzing-kubernetes-audit-logs, review-code, game-server-security.