Security Review agent skill
Trace trust boundaries and risky data flows through a codebase using GitHub’s reusable review workflow.
Profile reviewed by the Vibe Coding Editorial Team · Updated 2026-09-04
Installation
Review the source, then run the command
gh skills install github/awesome-copilot security-reviewRequires GitHub CLI 2.90.0 or newer and a codebase you are authorized to review.
Best for
- Pre-merge security review
- Auth and permission changes
- Input, secret, and data-flow analysis
What it adds
- Reasons across components and follows untrusted input toward sensitive operations.
- Looks for authorization, secret handling, injection, and unsafe boundary assumptions.
- Produces review findings that can be checked against the actual implementation.
- 01Map entry points, trust boundaries, sensitive data, and privileged operations.
- 02Trace realistic attacker-controlled inputs through the implementation.
- 03Rank findings by evidence and impact, then recommend testable remediations.
Skills are instructions with consequences
- An agent review is not a substitute for threat modeling or professional assessment.
- Validate every finding; both false positives and missed vulnerabilities are possible.
- Do not expose secrets, production data, or private code to an unauthorized model.
Try asking
Primary source
Read the original before installing
This page is an independent editorial profile, not a mirror of the skill. The publisher’s repository remains the source of truth for files, license terms, changes, and installation support.
Awesome GitHub Copilot
GitHub · MIT; check bundled files · reviewed 2026-09-04
Open the exact skill directory on GitHub.
Security Review FAQ
Questions before installation
Check fit, compatibility, prerequisites, permissions, and source ownership before adding this skill to a coding agent.
What does the Security Review agent skill do?
Trace trust boundaries and risky data flows through a codebase using GitHub’s reusable review workflow. Its main capabilities include reasons across components and follows untrusted input toward sensitive operations; looks for authorization, secret handling, injection, and unsafe boundary assumptions; produces review findings that can be checked against the actual implementation.
When should I use security-review?
Use it for pre-merge security review, auth and permission changes, input, secret, and data-flow analysis. A skill is most useful when this is a recurring workflow and its instructions improve results compared with a normal one-off prompt.
Which coding agents are compatible with security-review?
The current profile lists GitHub Copilot, VS Code, Copilot CLI. Skill support changes quickly, so confirm the latest installation directory, discovery behavior, and tool permissions in your agent’s documentation before installing.
What do I need before installing this skill?
You need GitHub CLI 2.90.0 or newer and a codebase you are authorized to review. The listed command uses GitHub CLI; inspect the exact source directory and its bundled files before running it.
Can this skill run commands or change files?
A skill supplies instructions and resources to an agent. Whether it can run commands, edit files, browse, or call external services depends on the tools and permissions available to that agent. Review requested actions at runtime and keep sensitive operations approval-gated.
Is this skill maintained by Vibe Coding?
No. GitHub publishes the original skill. Vibe Coding provides an independent profile and source link, reviewed on 2026-09-04, but the upstream repository remains the source of truth for updates, support, and license terms.
Install with context
Inspect the source, then test the skill on a real task.
Use a disposable branch or workspace, compare the result with and without the skill, and keep it only when the workflow becomes more reliable.
gh skills install github/awesome-copilot security-review