Security Review
Review a change, module, or surface for exploitable defects, trust boundaries...
Install
npx skills add codewhale-hq/Codewhale --skill security-review -g -a claude-code -y- Repository
- codewhale-hq/Codewhale41.2k
- Category
- Security
- Updated
- 3d ago
- License
- MIT
- Context cost
- Lightabout 746 tokens
- Runs scripts
- No, instructions only
What it does
Review a change, module, or surface for exploitable defects, trust boundaries, authn/authz, injection, secret exposure, filesystem and network reach, dependency risk. Use when the user asks for a security review, audit, or vulnerability check of concrete code. Not for general code review, lint, or compliance paperwork.
Security Review
Produce findings a reviewer can verify, not a vibes pass. Every finding names the file, the reachable path that makes it real, and the fix.
Scope the review first
- What is under review: a diff, a module, a plugin bundle, a network surface. Say the boundary out loud before reading.
- Trust boundaries: where untrusted input enters (HTTP handlers, MCP tool args, file parsers, CLI flags, env vars, rendered content) and where authority is exercised (fs writes, network egress, process spawn, credential reads, signing).
- Prerequisites: a checked-out tree and the project's own test runner. Ask for credentials only if a live path genuinely needs them; never read secrets from the environment or keychain yourself.
