Menu

Individual skill

appsec

0upvotes

Code reviewer with one entry point: /appsec. Use whenever the user wants code reviewed: current-branch work including uncommitted and new files ('review my changes', 'review this branch'), a Merge/Pull Request by number or URL ('review MR 123'), several MRs, or a whole repo/directory ('audit the whole repo', 'pre-pentest sweep'). Auto-detects scope and risk, no questions; runs two equal tracks: SECURITY (OWASP/CWE: injection, access control, auth/session, SSRF, XSS, deserialization, crypto, DoS, race, secrets, supply chain, CI/CD, mobile MASVS, LLM/agent/MCP, domain hunting (HTTP smuggling, OAuth/SAML, tenant isolation, cloud IAM, native memory); invariant-based hunting, 5 verification gates, 'needs validation' verdict) and CODE (correctness, business logic vs spec, migrations/API compatibility, performance, over-engineering, tests, conventions; 4 gates). Large or risky changes get the deep engine: recon, coverage table, parallel hunters, independent verifiers. Returns a merge verdict.

appsec/SKILL.md

Read pinned source

Source commit 05010c7a8a5b87b5920d8e52c88cda0b93219708

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
Yes
Skill scan complete
Yes
Observed behavior
Network or broad shell
Last checked
Nov 11, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
11
Repository last updated
Oct 19, 2026
License
MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# appsec

One purpose: **code review**. One command: **`/appsec`**. Everything after it is optional plain language, not flags:

| Goal | Example |
|---|---|
| Work in progress on this branch (including uncommitted, new files) against the target branch | `/appsec` |
| MR/PR by number or link | `/appsec 123`, `/appsec !123`, `/appsec <URL>` |
| Anything else | `/appsec against develop`, `/appsec uncommitted only`, `/appsec be thorough`, `/appsec audit the whole repo`, `/appsec src/billing`, `/appsec 123. Spec: ...` |

The skill decides scope, standard or deep review, which domains to hunt, and the independent reviewer on its own; it does not ask again unless it cannot continue. It always reviews two equal tracks: **Security** and **Code** (logic, business rules, design, over-engineering, performance, tests, conventions). Respond in the user's language (default English); keep code and identifiers in English.

**Follow [workflows/review.md](workflows/review.md).** Deep review (large/risky diff, whole repo, or the user says "thorough") automatically moves the Security track to [workflows/review-deep.md](workflows/review-deep.md).
Back to top