Skill Security Reviewer

Security review and threat analysis for agent skills. Use when reviewing, auditing, or validating skills for security issues including prompt injection, code execution risks, data exfiltration, supply chain vulnerabilities, and policy violations. Triggers on requests to "review a skill", "audit skill security", "check skill for vulnerabilities", "validate skill safety", or any security assessment of SKILL.md files and their associated scripts/assets.

9 stars 1 forksSecurity

Install

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add oguzhantopgul/skill-security-reviewer --skill skill-security-reviewer

Manual install

git clone --depth 1 https://github.com/oguzhantopgul/skill-security-reviewer.git /tmp/skill-security-reviewer
mkdir -p ~/.claude/skills
cp -r /tmp/skill-security-reviewer/. ~/.claude/skills/skill-security-reviewer

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

# Skill Security Reviewer

This skill teaches you how to perform intelligent security reviews of agent skills. Unlike static scanners that match patterns, you bring reasoning, context understanding, and the ability to detect novel attacks.

## Your Role as a Security Reviewer

You are performing a **threat analysis**, not a syntax check. Your job is to:

1. Understand what the skill claims to do
2. Understand what it actually does
3. Identify gaps, risks, and malicious patterns
4. Reason about intent, not just syntax

**Key mindset**: Assume the skill author could be malicious, careless, or compromised. Your job is to protect users who will trust this skill.

## Review Process

### Step 1: Gather All Skill Components

Before analysis, collect everything. The skill may be provided as a local path or a remote URL.

**If the user provides a URL** (e.g., a GitHub repository URL):
1. Clone or download the repository to a temporary directory (e.g., using `git clone` with `--depth 1` for efficiency)
2. Proceed with the review using the local copy
3. Clean up the temporary directory after the review is complete

**Expected skill structure**:
```
skill-folder/
├── SKILL.md          # Core instructions and metadata
├── scripts/          # Executable code
├── references/       # Documentation loaded into context
└── assets/           # Templates, files used in output
```

Read the full skill on GitHub

Details

Skill name: skill-security-reviewer
Repository: oguzhantopgul/skill-security-reviewer
Repo updated: 20 August 2026

FAQ

What does the Skill Security Reviewer skill do?

How do I install the Skill Security Reviewer skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add oguzhantopgul/skill-security-reviewer --skill skill-security-reviewer. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is Skill Security Reviewer popular?

It lives in oguzhantopgul/skill-security-reviewer, which has 9 GitHub stars and 1 forks.

Related skills

Spinal Pro

Zeeh-Lin/spinal-pro

End-to-end SpinalHDL skill for generating, reviewing, explaining, and validating RTL (Scala HDL). Covers DSL semantics (`:=`, `<>`, `Reg`, `Stream`, `Flow`, `Bundle`, `Vec`, `ClockDomain`, `StateMachine`, `Mem`, `BusSlaveFactory`), pipeline and plugin composition (`spinal.lib.misc.pipeline`, `spinal.lib.misc.plugin`), simulation with `SimConfig`/`doSim`, and architecture patterns drawn from official SpinalHDL docs and VexRiscv. Load for SpinalHDL DSL questions, module implementation, interface design, SoC integration, bug hunting, error-message decoding, and simulation or build validation.

Security

SAAS Security

vitormiziara/saas-security

Comprehensive SaaS security skill covering code auditing, checklist generation, and vulnerability reporting. TRIGGER this skill whenever the user asks to: audit code for security issues, review a codebase for vulnerabilities, generate a security checklist, check for OWASP compliance, review authentication or authorization logic, check for injection risks, race conditions, or insecure configurations, or asks anything related to SaaS security hardening. Also trigger proactively when the user shares code and asks for a review — always include a security perspective using this skill.

Security

Oma Lwm2m Expert

svdwalt007/Best-LwM2M-Agentic-Skills

OMA LwM2M expert: specs v1.0–v1.2.2 plus v2.0 roadmap, object/resource data model, transports, security, ecosystem. Trigger on: LwM2M, Lightweight M2M, OMA SpecWorks, OMNA registry, OMA-TS-LightweightM2M, CoAP (RFC 7252/7641/7959/8323), DTLS, DTLS CID (RFC 9146), DTLS 1.3, RRC (RFC 9853), OSCORE (RFC 8613), PSK, RPK, X.509, EST, SNI, NoSec, TLV, SenML JSON/CBOR, LwM2M CBOR, bootstrap, Bootstrap-Pack, registration, endpoint name, Profile ID, Queue Mode, bindings (UDP/TCP/SMS/Non-IP/LoRaWAN/MQTT/HTTP/ WebSockets), Read/Write/Execute/Discover, composite operations, Send, observe/notify, notificat

Security

Repo Seed

EricSanchezok/repo-seed

Seed, audit, adopt, and progressively evolve an agent-native repository with risk-triggered specs, durable decisions, resident governance skills, capability state, deterministic gates, and safe upgrades. Use when initializing or upgrading a repository, when an unmanaged repository grows complex, or when delivery, ownership, security, release, or incident signals suggest a governance capability is missing.

Security

Security Review

Dilaz/security-review-skill

Use when performing security audits, vulnerability assessments, penetration testing, or when asked to find security issues. Use when encountering code that handles user input, executes commands, reads files, or makes network requests.

Security

My Security Auditor

leomarviegas/my-security-auditor

Comprehensive authorized security audit skill covering web, APIs, cloud, Kubernetes, mobile, AI/LLM, microservices, SaaS (multi-tenancy, SSO, BYOK), plus red/blue/purple team operations. Integrates OWASP (Top 10, API/Mobile/LLM/Cloud/K8s, ASVS, SAMM, WSTG, MASVS), MITRE ATT&CK + D3FEND, OSSTMM with RAV, NIST RMF/CSF, FAIR, ISO 27001 family, CVSS/EPSS/SSVC, Zero Trust (800-207, CISA ZTMM), SABSA, CIS, CSA CCM, SOC 1/2/3, PCI-DSS v4.0.1, GDPR/LGPD/CCPA/HIPAA privacy, customer trust deliverables (DPAs, CAIQ/SIG, VDPs), SOC operations, detection engineering, threat hunting, adversary emulation (CA

Security

Browse the most popular Claude skills, all security skills, or write your own with the skills generator.