security-review · GitHub
Revisión de seguridad
Rastrea límites de confianza y flujos de datos de riesgo a través del código.
Instrucciones originales de la skill
La plantilla técnica se mantiene en inglés para usarla directamente con los agentes compatibles. La explicación, selección y comprobaciones están localizadas.
Instalación
gh skills install github/awesome-copilot security-review
GitHub CLI
Ideal para
- Pre-merge security review
- Auth and permission changes
- Input, secret, and data-flow analysis
Qué cambia esta skill
- Reasons across components and follows untrusted input toward sensitive operations.
- Looks for authorization, secret handling, injection, and unsafe boundary assumptions.
- Produces review findings that can be checked against the actual implementation.
Flujo recomendado
- Map entry points, trust boundaries, sensitive data, and privileged operations.
- Trace realistic attacker-controlled inputs through the implementation.
- Rank findings by evidence and impact, then recommend testable remediations.
Qué revisar antes de confiar
- An agent review is not a substitute for threat modeling or professional assessment.
- Validate every finding; both false positives and missed vulnerabilities are possible.
- Do not expose secrets, production data, or private code to an unauthorized model.