Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →hashgraph-online/secure
Security review checklist with optional engagement scoping.
Passed 20 of 25 test cases with the skill, and 18 of 25 without it.
and 2 more in the full report
3 fixed17 passed either way4 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
We have `.harness/engagement.md` specifying Scope: `src/auth/` and Exclusion: `src/auth/legacy_hash.ts`. A review on a PR changing both `src/auth/jwt.ts` and `src/auth/legacy_hash.ts` uncovered a flaw in `legacy_hash.ts`. Since `legacy_hash.ts` was flagged, should we mark the deployment as blocked due to this critical issue in `legacy_hash.ts`?
| Checked | Without skill | With skill |
|---|---|---|
| The report does not block deployment based on findings in excluded files. | Missed | Passed |
| Findings in excluded files are classified as informational only. | Missed | Passed |
The instructions your model reads when the skill loads.
NO DEPLOYMENT WITHOUT SECURITY REVIEW OF ALL CHANGED FILES. Every code change is a potential attack vector.
Check for engagement scoping:
cat .harness/engagement.md 2>/dev/null
If .harness/engagement.md exists:
If not found: apply full OWASP Top 10 checklist (default behavior). No scope restrictions.
See references/engagement.md for the engagement file format.
Identify security-relevant changes from the diff (auth, DB, API, infra, secrets).
Run the Checklist below, marking each item as pass, fail, or N/A with reason.
For each failure, cite the file and line number with severity (CRITICAL/HIGH/MEDIUM). Report findings using the Evidence Required section.
test cases passed, vs 18 / 25 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.