Skip to content
China Explained

Security and Review Skills

Security and Review Skills

Section titled “Security and Review Skills”

Skills for threat modeling, static analysis, code review, and security-focused investigation.

Use this category when you know the broad job but still need to decide which skill is worth invoking. Start from the task, then check the source, dependency, first run, and exit conditions.

Skills in this category

Section titled “Skills in this category”
SkillBest forSource
Security Best Practices SkillReviews code for language-specific security vulnerabilities and practical hardening opportunities.officialskills.sh
Security Threat Model SkillCreates repository-specific threat models by identifying assets, trust boundaries, and attack paths.officialskills.sh
Ask Questions If Underspecified SkillForces clarification when requirements are too ambiguous for safe security-sensitive work.officialskills.sh
Audit Context Building SkillBuilds deep architectural context before security audit or investigation work.officialskills.sh
Static Analysis SkillUses static analysis tools such as CodeQL, Semgrep, and SARIF workflows.officialskills.sh
Semgrep Rule Creator SkillCreates and refines Semgrep rules for vulnerability detection.officialskills.sh
Insecure Defaults SkillFinds insecure defaults such as hardcoded secrets, default credentials, and weak crypto.officialskills.sh

How to choose

Section titled “How to choose”
  • Review a change where security assumptions matter more than style.
  • Translate broad risk concerns into concrete files, flows, and controls.
  • Use a specialized analysis workflow without making every coding task security-heavy.

Avoid this category when

Section titled “Avoid this category when”
  • The reviewer cannot access the relevant code or runtime configuration.
  • The request asks for exploit instructions against a third-party system.
  • The scope is too broad to produce actionable findings.

Decision table

Section titled “Decision table”
CheckGuidance
Main dependencyRepository access, scope, language/tooling context, and review target
Best first useDefine the asset, trust boundary, or diff before asking the skill to inspect risk.
Smallest safe scopeStart with a low-risk example, preview environment, small file, or read-only target so the result can be reviewed.
When to switchIf the task falls outside this category’s real boundary, go back to the Awesome Skills overview and choose a closer category.

Reading order

Section titled “Reading order”
  1. Security Best Practices Skill - Reviews code for language-specific security vulnerabilities and practical hardening opportunities.
  2. Security Threat Model Skill - Creates repository-specific threat models by identifying assets, trust boundaries, and attack paths.
  3. Ask Questions If Underspecified Skill - Forces clarification when requirements are too ambiguous for safe security-sensitive work.
  4. Audit Context Building Skill - Builds deep architectural context before security audit or investigation work.
  5. Static Analysis Skill - Uses static analysis tools such as CodeQL, Semgrep, and SARIF workflows.
  6. Semgrep Rule Creator Skill - Creates and refines Semgrep rules for vulnerability detection.
  7. Insecure Defaults Skill - Finds insecure defaults such as hardcoded secrets, default credentials, and weak crypto.

Nearby categories

Section titled “Nearby categories”
  • Browser, Testing, Quality - Skills for browser automation, local app checks, Core Web Vitals, accessibility, and web quality review.
  • Frontend and Design - Skills for UI composition, framework patterns, design reviews, and frontend implementation decisions.
  • Deployment and Platform Ops - Skills for deploying, configuring, and operating cloud platforms and hosting providers.
  • Documents and Knowledge Work - Skills for office files, PDFs, documentation research, and knowledge capture workflows.

Sources

Section titled “Sources”