Security Review

What it does

The source separates the reporting scope from the broader codebase research needed to understand a suspect pattern. It routes languages and infrastructure to supporting references, then asks for evidence of exploitability rather than reporting every occurrence of a dangerous-looking function.

Best for

Investigating security-sensitive changes when the reviewer can inspect callers, framework configuration and access-control behavior.

Tradeoffs and requirements

Some exclusions and severity choices are specific to this source’s threat model; authenticated users can still matter in a different review. Referenced material may carry its own license. Following a checklist does not replace testing or a comprehensive threat model.

Unknown; inspect source requirements and supporting scripts.

Install from the source

Inspect the pinned source snapshot and its supporting files first. The command selects this skill through the open-source skills CLI. Node.js and agent-specific setup may be required. Installation can download code. Catalog ingestion never executes skill instructions or install scripts.

npx skills add https://github.com/getsentry/skills/tree/d12f250460ffd961f549dbebf7eeb0cf4afd4c2e/skills/security-review --skill security-review

Review pinned skill folder ↗ · CLI documentation ↗

After source review, use npx skills check and npx skills update to inspect and apply upstream updates. Re-check changed instructions before running them.

Safety & review signals

Static review only. This is not a security audit or a guarantee of safety.

SKILL.md text only; scripts, dependencies and runtime behavior not audited.

• Credential Reference — review the source context.
• Network Access — review the source context.
• Shell Or Package Install — review the source context.

Allowed tools declaration: Read Grep Glob Bash Task. Runtime permissions and network behavior: Unknown.

AI Craft Pad Skill Score

86/100 · Metadata coverage 100% · Model 1.0

Scores summarize observable discovery signals. Popularity and repository activity apply to the whole repository. Unknown runtime safety earns no certification.

Documentation

100/100

100

Maintenance

100/100

100

License Clarity

100/100

100

Repository Health

100/100

100

Compatibility Evidence

80/100

80

Popularity

55/100

55

Originality

80/100

80

Static Safety

60/100

60

Suggested workflow

Establish the intended attack surface and read the relevant references. Trace data from its real origin through validation and privileged operations, then distinguish an exploitable path from a protected pattern.

How to judge the result

Require a concrete input, prerequisites and observed effect for each finding. Prefer a safe reproduction and regression case, and explicitly record coverage gaps rather than presenting the absence of reported issues as proof of security.