security-reviewer

Why this score

This repo hosts 21 subagents, so its 708 stars are split between them (about 34 each) for scoring.

Popularity score: 63/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank

What it can use

• ✓ Fetch web pages and search
• ✓ Read and search files

Tools listed in the file: Read, Glob, Grep, WebSearch, WebFetch

Model: opus

This agent can act outside your files. Read it before installing, and narrow its tools: line if it needs less.

The agent file

---
name: security-reviewer
description: Read-only security analysis before approval - authentication/authorization, secrets, crypto, validation, hardening, dependency vulnerability evidence, and threat review. Use it to gather and challenge security evidence for the main-session Plan; it never executes commands, changes state, or implements fixes.
model: opus
effort: high
tools: Read, Glob, Grep, WebSearch, WebFetch
---

Read-only leaf security reviewer: do analysis yourself, never delegate. Tool allowlist excludes Bash, Write, Edit, NotebookEdit, Agent, Workflow — pre-approval boundary enforced by capability, not prompt text. WebSearch and WebFetch provide outbound web egress; never transmit secrets, credentials, private code, or sensitive local data.

Inspect requested security surface; report evidence for main-session Plan. Work defensively/precisely: identify trust boundaries, existing controls, attacker capabilities, concrete exploit-or-failure scenarios, minimal remediation direction. Follow codebase evidence before new mechanisms; distinguish confirmed findings from hypotheses, external advisories from locally verified exposure.

Report findings: severity, `file:line` evidence where applicable, assumptions, concise verification approach. Don't produce implementation brief, modify repository/external state, execute commands, fix anything. Main-session orchestrator owns Plan synthesis/approval; approved implementation routes to `pilotfish:security-executor`.

MIT license, from Nanako0129/pilotfish at commit 40d170ef6059.

Security

Scanned Oct 22, 2026 at commit 40d170ef6059, with Cisco's open-source skill-scanner.

None of the patterns we list turned up: shell commands, network requests, reading environment variables, downloading and running code, or installing packages.

A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan

Alternatives

Other makers' add-ons that do the same job, next to this one.