Compétences security-quick-review
📦

security-quick-review

v1.0 Révision du contenu r2 Sûr ⚙️ Commandes externes

Review Code Changes for Security Risks

Code changes can introduce security problems that routine reviews miss. This skill guides focused AI triage with evidence, realistic severity, and concrete fixes.

Prend en charge: Claude Codex Code(CC)
Maintain this Skill? Claim it 🥉 78 Bronze

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent
Review the Skillstore skill "security-quick-review" from https://skillstore.io/skills/agentkitco-security-quick-review.md and its manifest at https://skillstore.io/api/skills/agentkitco-security-quick-review/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/agentkitco-security-quick-review.md manifest signé GET /api/skills/agentkitco-security-quick-review/manifest lockfile signé GET /api/skills/agentkitco-security-quick-review/lockfile

Tester

Utilisation de « security-quick-review ». Illustrative scenario: an endpoint accepts a record identifier but never verifies that the caller owns the record.

RĂ©sultat attendu:

  • Scope: the changed endpoint and its authorization checks; deployment behavior was not reviewed.
  • HIGH: Missing ownership validation could let an authenticated caller access another user's record by changing the identifier.
  • Fix: enforce record-level authorization on the server before returning data.
  • A real finding must include the affected file and line; this illustration has no source attachment.
  • Limits: automated triage, not a security audit.

Utilisation de « security-quick-review ». Illustrative scenario: a credential was removed from the current change but remains visible in repository history.

RĂ©sultat attendu:

  • Scope: the selected change and its repository history.
  • HIGH: A historical credential remains exposed even after removal from current code.
  • Fix: rotate or revoke the credential and investigate its use; deleting current text does not invalidate it.
  • Evidence should identify the source location without reproducing the secret value.
  • Could not verify: whether the credential remains active.

Audit de sécurité

Sûr
v2 • 22/10/2026 Ouvrir le rapport versionné

All five static findings are false positives from Markdown formatting, defensive terminology, and scoped code inspection. The only suggested commands inspect Git changes and history; the skill forbids live exploitation and repeating secret values. No evidence found of malicious instructions, credential exfiltration, or unsafe execution directives.

1
Fichiers analysés
47
Lignes analysées
0
Éléments à examiner
0
Faux positifs ignorés

Facteurs de risque

⚙️ Commandes externes (3)
SKILL.md:20 SKILL.md:25 SKILL.md:31-39
Le dernier audit statique et sémantique terminé n’a détecté aucun constat de sécurité confirmé. Cela ne prouve pas que le skill est sans effets secondaires.
Audité par: codex Voir l’historique des audits →
Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné
Évaluation de sécurité

Copier le lien du rapport

https://skillstore.io/skills/agentkitco-security-quick-review/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/agentkitco-security-quick-review/security.svg)](https://skillstore.io/skills/agentkitco-security-quick-review?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/agentkitco-security-quick-review?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentkitco-security-quick-review/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/agentkitco-security-quick-review.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Citations académiques (APA · BibTeX · CFF)

Citation APA

agentkitco. (2026). security-quick-review security audit report (audit version 2) [Author version 1.0]. Skillstore. https://skillstore.io/skills/agentkitco-security-quick-review/audits/2

Citation BibTeX

@techreport{agentkitco-agentkitco-security-quick-review-2026, author = {agentkitco}, title = {security-quick-review security audit report (audit version 2)}, institution = {Skillstore}, year = {2026}, number = {2}, url = {https://skillstore.io/skills/agentkitco-security-quick-review/audits/2}, note = {Author version 1.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "security-quick-review security audit report (audit version 2)" version: "1.0" type: report authors: - name: "agentkitco" date-released: "2026-10-22" url: "https://skillstore.io/skills/agentkitco-security-quick-review/audits/2" identifiers: - type: other value: "skillstore:agentkitco-security-quick-review:audit:2" description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen
55
Architecture
85
Maintenabilité
87
Contenu
65
Communauté
91
Conformité aux spécifications

Ce que vous pouvez créer

Check a Pull Request Before Merge

Review changed input handlers and related code for injection, exposed secrets, and unsafe error behavior.

Review Access Controls

Examine routes and actions for missing server-side checks and access to another user's records.

Inspect Dependency and Configuration Changes

Review package additions, lockfiles, debug settings, and new CI or cloud permissions within the selected change.

Essayez ces prompts

Review a Small Change 
Review my current diff for likely security issues. State the scope, cite evidence, suggest fixes, and list anything you cannot verify.
Inspect an Endpoint 
Review [endpoint] and its called code for untrusted input, injection, authentication, authorization, and data exposure. Report evidence and concrete fixes without live exploitation.
Check Secrets and Configuration 
Review [directory] and its scoped Git changes and history for exposed secrets, dependency risks, and configuration weaknesses. Never reproduce secret values; recommend rotation when needed.
Trace a Sensitive Workflow 
Review [workflow] across changed code and called modules. Trace authorization, input boundaries, unsafe operations, and failure behavior. Separate evidence from uncertainty and identify human-review needs.

Bonnes pratiques

  • Specify the diff, directory, endpoint, or workflow and include relevant called code.
  • Require file and line evidence, realistic impact, concrete fixes, and explicit verification gaps.
  • Rotate exposed secrets and obtain human review for workflows handling money, health, or identity data.

Éviter

  • Treating a clean triage report as proof that an application is secure.
  • Pasting secret values into reports or assuming deletion removes historical exposure.
  • Attempting live exploitation or accepting generic vulnerability lists without source evidence.

Foire aux questions

Is this a complete security audit?
No. It provides focused AI triage, not a security audit or penetration test.
Which AI tools are supported?
The marketplace lists Claude, Codex, and Claude Code. Review depth depends on available source context and tool access.
What does the review cover?
It covers secrets, untrusted input, injection, access controls, data exposure, unsafe operations, dependencies, configuration, and failure behavior.
Does it run attacks against live systems?
No. The skill prohibits live exploitation and allows code inspection and local tests.
How does it handle exposed secrets?
It requests source locations without secret values and recommends rotation because removal from current code does not erase Git history.
What should a useful report include?
Include scope, severity, source evidence, an abuse explanation, concrete fixes, clean categories, verification gaps, and the limits of automated triage.

Détails du développeur

Auteur

agentkitco

Licence

MIT

Version de l’auteur

v1.0

RĂ©vision Skillstore

r2

Avis de version

La version déclarée par l’auteur n’est pas un SemVer valide.

DĂ©pĂ´t

https://github.com/agentkitco/agentkit-dev-skills/tree/a5058856442fcb89bd538b1c01f94558488bfac3/skills/security-quick-review

RĂ©f

18efac79a818d7e997295839638fdd21906cfd1c

RĂ©cence de maintenance

22/10/2026

Utilisation

6 téléchargements · 0 vues

Structure de fichiers

đź“„ SKILL.md