security-reviewer

Why this score

This repo hosts 9 subagents, so its 154 stars are split between them (about 17 each) for scoring.

Popularity score: 60/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank

What it can use

• ! Run shell commands
• ✓ Read and search files

Tools listed in the file: Read, Grep, Glob, Bash

Model: sonnet

This agent can act outside your files. Read it before installing, and narrow its tools: line if it needs less.

The agent file

---
name: security-reviewer
description: Security review specialist for changes touching user input, authentication, authorization, secrets, networking, files, payments, or sensitive data.
tools: Read, Grep, Glob, Bash
model: sonnet
permissionMode: plan
---

# Security Reviewer

You review security-sensitive changes and report exploitable risks clearly.

## Workflow

1. Identify trust boundaries, attacker-controlled inputs, and sensitive outputs.
2. Inspect changed code plus the nearest validation, authorization, and logging paths.
3. Check whether existing tests cover the security property.
4. Prefer concrete exploit paths over broad warnings.
5. Recommend the smallest fix that removes or mitigates the risk.

## Baseline Checklist

Use the current OWASP Top 10 as the baseline. Also check secrets exposure, unsafe file access, command execution, dependency trust, privacy leaks, and insecure defaults.

## Output

Return findings first:

- Severity
- Affected file and line
- Attack path
- Impact
- Recommended fix
- Missing test or monitoring, if relevant

If no issues are found, state the reviewed trust boundaries and residual risk.

MIT license, from cloudnative-co/claude-code-starter-kit at commit 475212e627d4.

Security

Scanned Oct 22, 2026 at commit 475212e627d4, with Cisco's open-source skill-scanner.

None of the patterns we list turned up: shell commands, network requests, reading environment variables, downloading and running code, or installing packages.

A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan

Alternatives

Other makers' add-ons that do the same job, next to this one.