← All skills
openai-security-review
79 / 100 · Review before installing
Check before installing. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By alicewe1/alice_skill (GitHub) · security · 63 stars · scanned at commit 19a54ac
Perform Shannon-inspired, OpenAI/Codex-native defensive security reviews of local repositories and authorized web apps. Use when the user asks to audit code, review a repo for vulnerabilities, assess OWASP risks, map attack surface, create a stateful security review workspace, log into an authorized test account, run authenticated passive Playwright crawling, perform safe read-only validation, generate vulnerability hypotheses, prepare a pentest-style report without Shannon/Anthropic, or review…
Works with any agent that supports SKILL.md skills.
What this skill can do
Downloads and installs other software
The author does not mention this.
Found in 4 places.
Show 1 more
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 17 places.
Show 14 more
- _modules/openai-security-review/SKILL.md, line 55
python3 <skill-dir>/scripts/create_audit_workspace.py \ - _modules/openai-security-review/SKILL.md, line 64
python3 <skill-dir>/scripts/inventory.py \ - _modules/openai-security-review/SKILL.md, line 72
python3 <skill-dir>/scripts/backend_fingerprint.py --repo /path/to/repo --workspace /tmp/openai-security-review - _modules/openai-security-review/SKILL.md, line 84
python3 <skill-dir>/scripts/hypothesize.py \ - _modules/openai-security-review/SKILL.md, line 91
export OSR_USERNAME="test@example.com" - _modules/openai-security-review/SKILL.md, line 106
python3 <skill-dir>/scripts/safe_validate.py \ - _modules/openai-security-review/SKILL.md, line 114
node <skill-dir>/scripts/passive_crawl.mjs \ - _modules/openai-security-review/SKILL.md, line 124
python3 <skill-dir>/scripts/source_api_map.py \ - _modules/openai-security-review/SKILL.md, line 132
node <skill-dir>/scripts/role_matrix.mjs \ - _modules/openai-security-review/SKILL.md, line 143
python3 <skill-dir>/scripts/generate_report.py \ - _modules/openai-security-review/SKILL.md, line 202
python3 <skill-dir>/scripts/active_validate.py \ - _modules/openai-security-review/SKILL.md, line 212
python3 <skill-dir>/scripts/active_probe.py \ - _modules/openai-security-review/scripts/dataflow_risk_map.py, line 24
"shell_command": re.compile(r"\b(child_process|exec\s*\(|execFile\s*\(|spawn\s*\(|Runtime\.getRuntime\(\)\.exec|ProcessBuilder|subprocess\.|os\.system|shell_exe - _modules/openai-security-review/scripts/osr.mjs, line 6
import { spawn } from "node:child_process";
Connects to the internet
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 24 places.
Show 17 more
- _modules/openai-security-review/scripts/active_probe.py, line 47
def fetch(url: str, method: str = "GET", timeout: int = 10, headers: dict | None = None, follow_redirects: bool = True) -> dict: - _modules/openai-security-review/scripts/active_probe.py, line 48
request = urllib.request.Request( - _modules/openai-security-review/scripts/active_probe.py, line 54
handlers = [urllib.request.HTTPSHandler(context=context)] - _modules/openai-security-review/scripts/active_probe.py, line 57
opener = urllib.request.build_opener(*handlers) - _modules/openai-security-review/scripts/active_probe.py, line 124
response = fetch(target_url, method="OPTIONS", timeout=timeout, headers=headers) - _modules/openai-security-review/scripts/active_probe.py, line 151
response = fetch(url, method="GET", timeout=timeout, follow_redirects=False) - _modules/openai-security-review/scripts/active_probe.py, line 165
response = fetch(url, method="GET", timeout=timeout) - _modules/openai-security-review/scripts/active_probe.py, line 178
response = fetch(url, method="GET", timeout=timeout) - _modules/openai-security-review/scripts/active_probe.py, line 191
response = fetch(url, method="GET", timeout=timeout) - _modules/openai-security-review/scripts/backend_probe.mjs, line 106
return await fetch(url, { ...options, signal: controller.signal, redirect: "manual" }); - _modules/openai-security-review/scripts/dataflow_risk_map.py, line 25
"server_request": re.compile(r"\b(fetch\s*\(|axios\.|requests\.(get|post)|http\.Get|http\.Post|RestTemplate|WebClient|curl_exec|Net::HTTP)\b", re.I), - _modules/openai-security-review/scripts/inventory.py, line 52
"api_client": re.compile(r"\b(fetch|axios|XMLHttpRequest|baseURL|endpoint|api)\b", re.I), - _modules/openai-security-review/scripts/role_matrix.mjs, line 166
const response = await fetch(browserEndpoint.url, { - _modules/openai-security-review/scripts/safe_validate.py, line 11
import urllib.request - _modules/openai-security-review/scripts/safe_validate.py, line 24
def fetch(url: str, method: str = "GET", timeout: int = 10) -> dict: - _modules/openai-security-review/scripts/safe_validate.py, line 25
request = urllib.request.Request(url, method=method, headers={"User-Agent": "openai-security-review/1.0"}) - _modules/openai-security-review/scripts/safe_validate.py, line 28
with urllib.request.urlopen(request, timeout=timeout, context=context) as response:
and 4 more places
Safer alternatives
Low-risk skills in the same category (security) that look related. Check that one does what you need.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'openai-security-review' ] || [ -L ~/.agents/skills/'openai-security-review' ]; then echo 'A skill folder named openai-security-review already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/alicewe1/alice_skill' "$d" && git -C "$d" checkout --quiet '19a54ac988e9929160334271f5c1924ddd9b227e' -- '_modules/openai-security-review' && mkdir -p ~/.agents/skills && cp -R "$d"/'_modules/openai-security-review' ~/.agents/skills/'openai-security-review' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'openai-security-review' ~/.claude/skills/'openai-security-review' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for alicewe1/alice_skill shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/alicewe1/alice_skill/)
Score history
| Date | Version | Score |
|---|
| 2026-11-07 | 19a54ac | 79 |