# Security Review

> Use when a change affects trust boundaries such as authentication, authorization, untrusted input, secrets, or sensitive data handling. This skill identifies security risks, abuse cases, and verification steps without replacing implementation review.

- **Type:** Skill
- **Install:** `agentstack add skill-motao123-dev-workflow-kit-security-review`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [motao123](https://agentstack.voostack.com/s/motao123)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [motao123](https://github.com/motao123)
- **Source:** https://github.com/motao123/dev-workflow-kit/tree/main/security-review
- **Website:** https://motao123.github.io/dev-workflow-kit/

## Install

```sh
agentstack add skill-motao123-dev-workflow-kit-security-review
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Security Review

Use this skill when a change could introduce or expose security-sensitive behavior.

## Trigger Conditions

Use this skill when:
- auth or permission logic changes
- user-controlled input reaches storage, commands, templates, or queries
- secrets, tokens, uploads, redirects, or external callbacks are involved
- the user asks for a security pass before merge
- a feature creates new trust boundaries or expands existing ones

Do not use this skill as a generic code-quality pass when no security surface is involved.

## Workflow

1. Identify assets, trust boundaries, and user-controlled inputs.
2. Map the relevant attack surfaces.
3. Check for common failure modes such as injection, exposure, broken access control, and unsafe defaults.
4. Rate the likely severity and exploitability.
5. Recommend the smallest effective mitigations.
6. Suggest verification for the mitigations.

## Output

For non-trivial work, provide:
- surfaces reviewed
- risks found
- severity or priority
- mitigations
- verification suggestions
- remaining unknowns

## Coordination

After review:
- hand off to the repo's coding workflow for code changes
- use `ship-readiness` when security findings affect release decisions
- use `docs-writer` if operational guidance or migration notes are needed

## Invocation Examples

- "Use security-review on this auth change before we merge it."
- "Use security-review for this file-upload flow and list the main risks."
- "Use security-review to check this endpoint for trust-boundary mistakes."

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [motao123](https://github.com/motao123)
- **Source:** [motao123/dev-workflow-kit](https://github.com/motao123/dev-workflow-kit)
- **License:** MIT
- **Homepage:** https://motao123.github.io/dev-workflow-kit/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-motao123-dev-workflow-kit-security-review
- Seller: https://agentstack.voostack.com/s/motao123
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.