Menu

Individual skill

security-review

Review a diff, branch, or PR for exploitable security defects. Fans out read-only subagents per defect class (injection, authz, secrets, SSRF, supply chain, CI permissions, agent tool and MCP config, and more) and reports only findings backed by file:line, an exploit path, and evidence. Ends with block, fix-before-merge, or ok.

plugins/requie/endostack/skills/security-review/SKILL.md

Read pinned source

Source commit d780783eba4ecc7c8b9429f95c9362df95f07c61

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
No
Skill scan complete
No
Observed behavior
Network or broad shell
Last checked
Nov 4, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
1,531
Repository last updated
Nov 6, 2026
License
Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# security-review

Find the security defects a change introduces and prove each one. Every reported finding cites `file:line`, describes how an attacker reaches it, and carries evidence: a failing test, a reproduction, or a precise trace through the code. Anything you suspect but cannot show goes in a separate "needs verification" list, where it cannot be mistaken for a confirmed bug. Generic advice ("consider adding rate limiting", "validate all inputs") is not reported at all, because a reviewer cannot act on it and it buries the findings that matter.

This skill reports. It does not edit code. If the user wants fixes, they ask after reading the verdict.

Use the `threat-model` skill (`../threat-model/SKILL.md`) for design-level questions before code exists. Use the `interrogate` skill (`../interrogate/SKILL.md`) for a general adversarial review across correctness and design. This skill covers only exploitable security defects, with more depth per class than a general review gives.

## Inputs

Determine what to review from context, in this order:

1. A PR number or URL the user gave: fetch its diff and description.
2. Files or a diff the user pointed at.