securityby codexstar69

Security Review

codexstar69/security-review

Source codexstar69/bug-hunter ↗License MIT

Run a focused STRIDE-based security review using Bug Hunter-native artifacts.

SkillScore59Maintained

Automatic

Security & AppSec pack

Last verified 8/19/2026

What it changes

Passed 13 of 22 test cases with the skill, and 7 of 22 without it.

Without skill32%

With skill59%

Checks it passed that the model alone missed

filters findings based on exploitability
stores review artifacts under .bug-hunter/
outputs results to .bug-hunter/dep-findings.json

and 7 more in the full report

7 fixed6 passed either way8 still failing1 broke

Pass-rate lift: +27 pp
Tokens: -21%
Agent turns: 0%
Response time: -35%

Model gemini-3.6-flashMeasured 8/19/2026v213 of 22 cases passed with skill

Tokens, turns and time describe resource use, not a dollar price.

Use this skill

Save it into your project's skills folder. Claude Code picks it up in its next session.

curl -fsSL --create-dirs -o .claude/skills/codexstar69-security-review/SKILL.md https://app.decimal.ai/s/codexstar69-security-review/SKILL.md

Want it pinned and updatable? pip install "decimalai>=0.15", then decimalai skills add codexstar69-security-review, and start Claude Code with claude --plugin-dir "$(git rev-parse --show-toplevel)/.agents"

1 · One-time — install the CLI (docs ↗)

pip install "decimalai>=0.15"

2 · Get the skill — writes .agents/skills/codexstar69-security-review/ and pins it in .decimal/skills.lock

decimalai skills add codexstar69-security-review

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/codexstar69-security-review/SKILL.md https://app.decimal.ai/s/codexstar69-security-review/SKILL.md

Raw file: /s/codexstar69-security-review/SKILL.md ↗ · machine-readable summary at /s/codexstar69-security-review.json ↗

Safety checks: 3 of 3 passed

Code scan CleanIntent PassedContent Clean

What's inside

The instructions your model reads when the skill loads.

SKILL.md52 linessingle file

Security Review

This is a bundled local Bug Hunter companion skill. It packages a security-focused review workflow without introducing any external marketplace dependency.

Purpose

Use this skill for deeper security audits than a simple bug hunt, especially when the user wants:

a full security review
PR security validation
weekly security scanning
dependency reachability + code review together
threat-model-driven analysis

Workflow

Ensure .bug-hunter/threat-model.md exists.
- If missing, invoke the bundled threat-model-generation skill.
Determine the scan mode from the request:
- PR → diff-scoped review via commit-security-scan
- staged → staged-only security review
- weekly → recent commit range on the default branch
- full → full repository security audit
If dependency scanning is relevant, run:
- node scripts/dep-scan.cjs --target <path> --output .bug-hunter/dep-findings.json
Scan code for STRIDE threats using Bug Hunter-native conventions. Reuse:
- .bug-hunter/triage.json
- .bug-hunter/threat-model.md
- .bug-hunter/security-config.json
- .bug-hunter/dep-findings.json
Validate severe findings using the bundled vulnerability-validation skill.
Produce structured outputs compatible with the Bug Hunter pipeline.

Outputs

Track record

Benchmark

13 / 22

test cases passed, vs 7 / 22 without

Adoption

Users: 0
Times used: 0

Safety and source details

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/10/2026

View 15 scanner checks

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

codexstar69 / bug-hunter

skills/security-review/SKILL.md

View on GitHub ↗

License MITImported 8/10/2026Version v2

Other skills for the same job

Published skills whose descriptions closely match this one, with their headline benchmark lift.

codexstar69/commit-security-scanScan code changes for security vulnerabilities using Bug Hunter-native artifacts and STRIDE context. Use whenever the user asks for PR security review, commit-diff scanning, staged-change security checks, branch-comparison security review, or pre-merge security analysis of changed code.Close match+32 pp pass-rate lift

More skills from the same source and nearby in the registry, with their headline benchmark lift.

+9 pp pass-rate lift

code-yeongyu/agent-browserAutomates browser interactions for web testing, form filling, screenshots, and data extraction. Use when the user needs to navigate websites, interact with web pages, fill forms, take screenshots, test web applications, or extract information from web pages.+68 pp pass-rate lift

code-yeongyu/ast-grepUse ast-grep (sg) for AST-aware code search and rewrite across 25 languages. Trigger for structural code matching or deterministic codemods: find every function/call/class/import shaped like X, rewrite console.log to logger.info, strip `as any`, migrate require() to import, find empty catch blocks or missing await, and scan/apply YAML rules. Prefer this over rg/grep when the target is syntax shape rather than text; use rg for string contents, comments, filenames, or regex-style byte searches.+27 pp pass-rate lift

code-yeongyu/codex-qaQA the omo Codex Light edition (lazycodex / packages/omo-codex) itself, in strict isolation so ONLY our plugin is exercised, never the user's real ~/.codex. The first-party method drives the real `codex app-server` against an isolated CODEX_HOME plus a LOCAL mock model (no real API call), and proves a plugin hook fired by asserting hook/started + hook/completed notifications. Also: isolated install verification, per-component hook probes, a tmux TUI smoke, and runtime log observation (RUST_LOG /+73 pp pass-rate lift

code-yeongyu/coding-agent-sessionsMUST USE when asked to find, read, list, search, inspect, fetch, export, or reconstruct coding-agent sessions across Codex, Claude Code/Desktop, OpenCode, Senpi/pi, oh-my-pi (omp), gajae-code (gjc), OpenClaw, Factory Droid, Amp, Gemini/Kimi/Qwen CLIs, Codebuff, Roo/Kilo/Cline, Kodu, Cursor CLI, Aider, Aside browser-agent sessions, or unknown local agent logs. Covers transcripts, session IDs, rollout JSONL, state SQLite, Claude projects/pre-compact histories, OpenCode messages/parts, child/subage+27 pp pass-rate lift

code-yeongyu/comment-checkerUse when Codex needs to understand or respond to automatic comment-checker feedback emitted after an edit-like PostToolUse hook.+55 pp pass-rate lift

Ready to supercharge your AI agents?

What's inside

Security Review

Purpose

Workflow

Outputs

Track record

Benchmark

Adoption

SkillSafety

Source

Other skills for the same job

Related skills