security-review
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access
Profile →npx skills add github/awesome-copilot --skill security-review --agent copilot
Same command for any agent — swap --agent for claude-code, codex, cursor.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Security Review An AI-powered security scanner that reasons about your codebase the way a human security researcher would — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. ## When to Use This Skill Use this skill when the request involves: - Scanning a codebase or file for security vulnerabilities - Running a security review or vulnerability check - Checking for SQL injection, XSS, command injection, or other injection flaws - Finding exposed API keys, hardcoded secrets, or credentials in code - Auditing dependencies for known CVEs - Reviewing authentication, authorization, or access control logic - Detecting insecure cryptography or weak randomness - Performing a data flow analysis to trace user input to dangerous sinks - Any request phrasing like "is my code secure?", "scan this file", or "check my repo for vulnerabilities" - Running `/security-review` or `/security-review <path>` ## How This Skill Works Unlike traditional static analysis tools that match patterns, this skill: 1. **Reads code like a security researcher** — understanding context, intent, and data flow 2. **Traces across files** — following
- When to Use This Skill
- How This Skill Works
- Execution Workflow
- Step 1 — Scope Resolution
- Step 2 — Dependency Audit
- Step 3 — Secrets & Exposure Scan
- Step 4 — Vulnerability Deep Scan
- Step 5 — Cross-File Data Flow Analysis
- Step 6 — Self-Verification Pass
- Step 7 — Generate Security Report
- Step 8 — Propose Patches
- Severity Guide
- Output Rules
- Reference Files
What does the security-review skill do?
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access
How do I install it?
Run `npx skills add github/awesome-copilot --skill security-review --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From github/awesome-copilot, a repository with 37,432 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.