Habilidades security-quick-review
📦

security-quick-review

v1.0 Revisión del contenido r2 Seguro ⚙️ Comandos externos

Review Code Changes for Security Risks

Code changes can introduce security problems that routine reviews miss. This skill guides focused AI triage with evidence, realistic severity, and concrete fixes.

Compatible con: Claude Codex Code(CC)
Maintain this Skill? Claim it 🥉 78 Bronce

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente
Review the Skillstore skill "security-quick-review" from https://skillstore.io/skills/agentkitco-security-quick-review.md and its manifest at https://skillstore.io/api/skills/agentkitco-security-quick-review/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/agentkitco-security-quick-review.md Manifest firmado GET /api/skills/agentkitco-security-quick-review/manifest Lockfile firmado GET /api/skills/agentkitco-security-quick-review/lockfile

Pruébalo

Usando "security-quick-review". Illustrative scenario: an endpoint accepts a record identifier but never verifies that the caller owns the record.

Resultado esperado:

  • Scope: the changed endpoint and its authorization checks; deployment behavior was not reviewed.
  • HIGH: Missing ownership validation could let an authenticated caller access another user's record by changing the identifier.
  • Fix: enforce record-level authorization on the server before returning data.
  • A real finding must include the affected file and line; this illustration has no source attachment.
  • Limits: automated triage, not a security audit.

Usando "security-quick-review". Illustrative scenario: a credential was removed from the current change but remains visible in repository history.

Resultado esperado:

  • Scope: the selected change and its repository history.
  • HIGH: A historical credential remains exposed even after removal from current code.
  • Fix: rotate or revoke the credential and investigate its use; deleting current text does not invalidate it.
  • Evidence should identify the source location without reproducing the secret value.
  • Could not verify: whether the credential remains active.

Auditoría de seguridad

Seguro
v2 • 22/10/2026 Abrir el informe versionado

All five static findings are false positives from Markdown formatting, defensive terminology, and scoped code inspection. The only suggested commands inspect Git changes and history; the skill forbids live exploitation and repeating secret values. No evidence found of malicious instructions, credential exfiltration, or unsafe execution directives.

1
Archivos escaneados
47
Líneas analizadas
0
Elementos de revisión
0
Falsos positivos ignorados

Factores de riesgo

⚙️ Comandos externos (3)
SKILL.md:20 SKILL.md:25 SKILL.md:31-39
La auditoría estática y semántica completada más reciente no detectó hallazgos de seguridad confirmados. Esto no demuestra que el skill no tenga efectos secundarios.
Auditado por: codex Ver historial de auditorías →
Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado
Evaluación de seguridad

Copiar enlace del informe

https://skillstore.io/skills/agentkitco-security-quick-review/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/agentkitco-security-quick-review/security.svg)](https://skillstore.io/skills/agentkitco-security-quick-review?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/agentkitco-security-quick-review?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentkitco-security-quick-review/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/agentkitco-security-quick-review.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Citas académicas (APA · BibTeX · CFF)

Cita APA

agentkitco. (2026). security-quick-review security audit report (audit version 2) [Author version 1.0]. Skillstore. https://skillstore.io/skills/agentkitco-security-quick-review/audits/2

Cita BibTeX

@techreport{agentkitco-agentkitco-security-quick-review-2026, author = {agentkitco}, title = {security-quick-review security audit report (audit version 2)}, institution = {Skillstore}, year = {2026}, number = {2}, url = {https://skillstore.io/skills/agentkitco-security-quick-review/audits/2}, note = {Author version 1.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "security-quick-review security audit report (audit version 2)" version: "1.0" type: report authors: - name: "agentkitco" date-released: "2026-10-22" url: "https://skillstore.io/skills/agentkitco-security-quick-review/audits/2" identifiers: - type: other value: "skillstore:agentkitco-security-quick-review:audit:2" description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio
55
Arquitectura
85
Mantenibilidad
87
Contenido
65
Comunidad
91
Cumplimiento de la especificación

Lo que puedes crear

Check a Pull Request Before Merge

Review changed input handlers and related code for injection, exposed secrets, and unsafe error behavior.

Review Access Controls

Examine routes and actions for missing server-side checks and access to another user's records.

Inspect Dependency and Configuration Changes

Review package additions, lockfiles, debug settings, and new CI or cloud permissions within the selected change.

Prueba estos prompts

Review a Small Change 
Review my current diff for likely security issues. State the scope, cite evidence, suggest fixes, and list anything you cannot verify.
Inspect an Endpoint 
Review [endpoint] and its called code for untrusted input, injection, authentication, authorization, and data exposure. Report evidence and concrete fixes without live exploitation.
Check Secrets and Configuration 
Review [directory] and its scoped Git changes and history for exposed secrets, dependency risks, and configuration weaknesses. Never reproduce secret values; recommend rotation when needed.
Trace a Sensitive Workflow 
Review [workflow] across changed code and called modules. Trace authorization, input boundaries, unsafe operations, and failure behavior. Separate evidence from uncertainty and identify human-review needs.

Mejores prácticas

  • Specify the diff, directory, endpoint, or workflow and include relevant called code.
  • Require file and line evidence, realistic impact, concrete fixes, and explicit verification gaps.
  • Rotate exposed secrets and obtain human review for workflows handling money, health, or identity data.

Evitar

  • Treating a clean triage report as proof that an application is secure.
  • Pasting secret values into reports or assuming deletion removes historical exposure.
  • Attempting live exploitation or accepting generic vulnerability lists without source evidence.

Preguntas frecuentes

Is this a complete security audit?
No. It provides focused AI triage, not a security audit or penetration test.
Which AI tools are supported?
The marketplace lists Claude, Codex, and Claude Code. Review depth depends on available source context and tool access.
What does the review cover?
It covers secrets, untrusted input, injection, access controls, data exposure, unsafe operations, dependencies, configuration, and failure behavior.
Does it run attacks against live systems?
No. The skill prohibits live exploitation and allows code inspection and local tests.
How does it handle exposed secrets?
It requests source locations without secret values and recommends rotation because removal from current code does not erase Git history.
What should a useful report include?
Include scope, severity, source evidence, an abuse explanation, concrete fixes, clean categories, verification gaps, and the limits of automated triage.

Detalles del desarrollador

Licencia

MIT

Versión del autor

v1.0

Revisión de Skillstore

r2

Aviso de versión

La versión declarada por el autor no es un SemVer válido.

Repositorio

https://github.com/agentkitco/agentkit-dev-skills/tree/a5058856442fcb89bd538b1c01f94558488bfac3/skills/security-quick-review

Ref.

18efac79a818d7e997295839638fdd21906cfd1c

Actualidad del mantenimiento

22/10/2026

Uso

6 descargas · 0 vistas

Estructura de archivos

📄 SKILL.md