# Security Review

Review a change, module, or surface for exploitable defects, trust boundaries...

- Repository: https://github.com/codewhale-hq/Codewhale (41164 stars)
- Category: Security
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add codewhale-hq/Codewhale --skill security-review -g -a claude-code -y`
Codex: `npx skills add codewhale-hq/Codewhale --skill security-review -g -a codex -y`
Cursor: `npx skills add codewhale-hq/Codewhale --skill security-review -g -a cursor -y`
Gemini CLI: `npx skills add codewhale-hq/Codewhale --skill security-review -g -a gemini-cli -y`

## Description

Review a change, module, or surface for exploitable defects, trust boundaries, authn/authz, injection, secret exposure, filesystem and network reach, dependency risk. Use when the user asks for a security review, audit, or vulnerability check of concrete code. Not for general code review, lint, or compliance paperwork.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Security Review

Produce findings a reviewer can verify, not a vibes pass. Every finding
names the file, the reachable path that makes it real, and the fix.

## Scope the review first

- **What is under review:** a diff, a module, a plugin bundle, a network
  surface. Say the boundary out loud before reading.
- **Trust boundaries:** where untrusted input enters (HTTP handlers, MCP
  tool args, file parsers, CLI flags, env vars, rendered content) and where
  authority is exercised (fs writes, network egress, process spawn,
  credential reads, signing).
- **Prerequisites:** a checked-out tree and the project's own test runner.
  Ask for credentials only if a live path genuinely needs them; never read
  secrets from the environment or keychain yourself.

## Procedure

The rest: https://github.com/codewhale-hq/Codewhale/blob/HEAD/crates/skills/assets/skills/security-review/SKILL.md