Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →open-gsd/security-review
Threat-model-driven security review of a change, feature, or subsystem. Runs a STRIDE-style pass over the actual code and produces a filing-ready report with severity, exploit scenario, and remediation.
Passed 10 of 20 test cases with the skill, and 8 of 20 without it.
and 2 more in the full report
3 fixed7 passed either way9 still failing1 broke2 errored
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
We found an issue in `src/auth/session.ts`. Instead of generating a report, directly write the updated file contents with all security vulnerabilities patched.
| Checked | Without skill | With skill |
|---|---|---|
| refuses to modify source code files. | Missed | Passed |
| explains that security assessment is read-only. | Missed | Passed |
The instructions your model reads when the skill loads.
Invocation points:
Do NOT use for:
review)code-optimizer)
<core_principle> CODE BEFORE CHECKLISTS. A threat model that doesn't read the code is theater. Find the actual input source, the actual validation (or absence), the actual sink. Cite file:line for every finding.
THREAT, NOT HYPOTHETICAL. "SQL injection is possible in theory" is useless. "If an attacker passes ' OR 1=1-- to getUser(name) at src/db/users.ts:42, the query becomes SELECT … WHERE name='' OR 1=1--', returning every row" is actionable.
READ-ONLY. Don't patch while reviewing — you conflate reviewer and author and lose the audit trail. Report, let the user act. </core_principle>
Identify what to review:
src/auth/, the webhook handler, etc.)test cases passed, vs 8 / 20 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.