Description
security-review is an agent skill from the github/awesome-copilot collection that scans a codebase for security vulnerabilities by reasoning about the code the way a security researcher would. Rather than matching patterns, it traces data flows from where input enters the system to where it is used, follows how components interact, and looks for the weaknesses that pattern-matching tools tend to miss, such as authorization logic that is applied in one path but not another. The skill is used when a request concerns a security review of the code or its architecture, and it reports the issues it finds with the reasoning behind each one. It is useful for teams that want a deeper review before a release, or a second opinion on a sensitive component, and for developers who want to understand how a vulnerability would be reached. An AI review can miss problems and can report problems that are not exploitable, so each finding should be confirmed, ideally with a test, and a human security review should cover the most sensitive parts before release. The skill is installed with the skills CLI from the github/awesome-copilot repository. Its skills.sh page showed about 5.4K installs and passing results from three security audits at the time of the scan.…
Highlights
- Traces data flows from input to use
- Follows component interactions
- Finds weaknesses pattern-matching tools miss
- Reports findings with reasoning
- Installs with the skills CLI
Ratings & Reviews
No ratings yet
Be the first to rate security-review.
People also visit
security-review FAQ
How does it differ from a pattern scanner?
It traces data flows and component interactions, rather than matching known patterns.
Can its findings be trusted without checking?
No. It can miss problems and report ones that are not exploitable, so confirm each finding.
Does it replace a human review?
No. Have a human security review cover the most sensitive parts before release.
How do I install it?
Run npx skills add https://github.com/github/awesome-copilot --skill security-review.
What security audits does it have?
skills.sh lists three audits: Gen Agent Trust Hub Pass, Socket Pass and Snyk Pass.
What are the best security-review alternatives?
Popular alternatives to security-review include cc-skill-security-review, golang-security and thermo-nuclear-review. See all security-review alternatives