SkillsAdd

sd0xdev/sd0x-harness

security-review

Security review via Codex exec. Use when: OWASP Top 10:2025 audit, dependency vulnerability check, security-sensitive changes. Not for: code review (use codex-code-review), test review (use test-review). Output: security findings + audit report.

First seen Mar 9, 2026

Installation

$ npx skills add sd0xdev/sd0x-harness --skill security-review
View on skills.sh ↗ GitHub repository ↗

Similar popular skills

Related neighbors and high-traction skills in the same topics — useful to compare before installing.

agent-browser Same topic
vercel-labs/agent-browser

Browser automation CLI for AI agents. Use when the user needs to interact with websites, includ…

810.4K installs
azure-diagnostics Same topic
microsoft/azure-skills

Debug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe …

568.9K installs
azure-validate Same topic
microsoft/azure-skills

Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure…

567.7K installs
azure-aigateway Same topic
microsoft/azure-skills

Configure Azure API Management as an AI Gateway for AI models, MCP tools, and agents. WHEN: sem…

566.3K installs
azure-compute Same topic
microsoft/azure-skills

Azure VM/VMSS router. WHEN: create / provision / deploy / spin-up VM, recommend VM size, compar…

510K installs
supabase-postgres-best-practices Same topic
supabase/agent-skills

Postgres best practices maintained by Supabase, for Postgres running anywhere. Load this skill …

391.6K installs

Also in this package

Other skills from sd0xdev/sd0x-harness · top by installs.

npx skills add sd0xdev/sd0x-harness
statusline-config 66 tech-spec 61 codex-code-review 27 codex-brainstorm 24 codex-explain 22 codex-implement 22 codex-architect 22 create-pr 21 best-practices 21 feasibility-study 21

Browse all from sd0xdev/sd0x-harness

More details

Agent compatibility

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Declared
Cursor Not declared
Codex Not declared
GitHub Copilot Not declared
Windsurf Not declared
Gemini CLI Not declared
Cline Not declared
OpenCode Not declared

Repository health

Stars 188
License LICENSE
Default branch main
Open issues 3
Status Active

Skill metadata

Parsed from SKILL.md frontmatter.

Allowed toolsBash(git:*), Read, Grep, Glob, Bash(node:*), Write
Declared agents claude-code

Package contents

Files included with this skill beyond the listing page.

  • skill md SKILL.md 4,513 B
  • docs SUMMARY.md 268 B

History

  1. First seen on skills.sh
  2. First recorded snapshot · 21 installs

SKILL.md

Security Review Skill

Trigger

  • Keywords: security review, OWASP, vulnerability, dep-audit, npm audit, dependency security

When NOT to Use

  • General code review (use codex-code-review)
  • Functional testing (use test-review)
  • Performance issues (not security-related)

Commands

Command Purpose When
/codex-security OWASP Top 10 audit Security-sensitive code
/dep-audit Dependency security audit Periodic / PR

Workflow: /codex-security

Determine scope → Collect changes → Codex OWASP review → Findings + Gate → Loop if Must fix

Step 1: Determine Scope

Parse --scope from arguments, default to src/.

Step 2: Collect Change Metadata

Metadata, not content: the first dispatch carries the changed-file list and diff stats, and Codex reads the diffs itself from the sandbox (@rules/codex-invocation.md § Required in every first-dispatch prompt). A truncated | head -1500 excerpt was the old shape, and it decided for the reviewer which 1500 lines of a security review mattered.

  1. CHANGED_FILES: git diff --name-only HEAD -- <scope> ∪ git ls-files --others --exclude-standard -- <scope>
  2. DIFF_STAT: git diff --stat HEAD -- <scope>
  3. SCOPE: the resolved scope argument, plus the security-relevant paths a

Glob("**/{auth,login,password,token,secret,key,credential}") surfaces — named as places to look, never pasted

Step 3: Codex Security Review

First review: dispatch per @skills/codex-code-review/references/codex-transport.md § Start with the OWASP prompt. See references/codex-prompt-security.md.

Save the returned threadId.

Loop review: dispatch per @skills/codex-code-review/references/codex-transport.md § Resume with the re-review template. See references/codex-prompt-security.md.

Step 4: Consolidate Output

Organize results into findings summary table + detailed findings + gate.

OWASP Top 10:2025

The version is part of the identifier: SSRF is no longer A10 (it sits inside A01), and A02–A06 renumbered, so a finding labelled with a 2021 code says something different to whoever reads it.

Code Category Check Focus
A01 Broken Access Ctrl IDOR, permission bypass, CORS, SSRF
A02 Misconfiguration Debug mode, default passwords
A03 Supply Chain Failures Vulnerable deps, unverified build sources
A04 Crypto Failures Sensitive data encryption, weak crypto
A05 Injection SQL/NoSQL/Cmd Injection, XSS
A06 Insecure Design Rate Limiting, business logic
A07 Auth Failures Brute force, session, weak passwords
A08 Integrity Failures Deserialization, CI/CD
A09 Logging & Alerting Sensitive data in logs, auditing, alerts
A10 Exceptional Conditions Error paths that fail open or leak

Review Loop

⚠️ @CLAUDE.md auto-loop: fix → re-review → ... → ✅ PASS ⚠️

⛔ Must fix → fix P0 issues → /codex-security --continue <threadId> → repeat until ✅ Mergeable.

Max 3 rounds. Still failing → report blocker.

Verification

  • Each issue tagged with severity (P0/P1/P2)
  • Gate is explicit (✅ Mergeable / ⛔ Must fix)
  • Fix recommendations are specific and actionable
  • Includes verification test method
  • Codex independently researched auth/input/sensitive code

References

  • OWASP prompt: references/codex-prompt-security.md
  • Examples: references/examples.md
  • Standards: @rules/security.md

Examples

Input: /codex-security --scope src/controller/
Action: OWASP Top 10 check → output issues + Gate

Input: /dep-audit --level high
Action: npm audit → filter high/critical → output report