Claude Codepasses structure
Checker 0.1.0 · agent-skills-2026-08-13+claude-code-docs-2026-08-13 · 8/16/2026.claude/skills/security-reviewRuntime, accounts, dependencies, permissions, network behavior and task quality remain untested.
Real Skill packageSource verifiedClawHub registry
security-review
Attacker's-eye security review of a diff, branch, or module — walks a fixed vulnerability catalog (missing authz on new endpoints, injection, secrets in code/logs, trusting client-sent identity, SSRF, path traversal, insecure deserialization, mass assignment, broken crypto, unsafe redirects, dependency CVEs) where every finding must name a concrete attack path (attacker does X → gains Y) or be demoted to hardening advice. Never claims "secure", only "nothing found in the classes checked". Use this skill whenever t…
Identity and source
Publisher attributionDennis Rongoregistry owner unverified by skillvetai
Functional categoryAgent Engineering, Security & Governanceautomatically inferred · 73% rule confidence
Package forminstruction bundle2 recorded files
Canonical sourceClawHub registryclawhub:dennisrongo:security-review
Platform declarations
These states come from the source or distribution context. None of the entries below are SkillVetAI compatibility test results.
OpenClawnative officialProvenance: registry distribution
Independent structural checks
These checks parse the fixed package against dated platform rules. They do not execute the Skill or verify task behavior.
OpenAI Codexpasses structure
Checker 0.1.0 · agent-skills-2026-08-13+codex-docs-2026-08-13 · 8/16/2026.agents/skills/security-reviewRuntime, accounts, dependencies, permissions, network behavior and task quality remain untested.
OpenClawpasses structure
Checker 0.1.0 · agent-skills-2026-08-13+openclaw-docs-2026-08-13 · 8/16/2026skills/security-reviewRuntime, accounts, dependencies, permissions, network behavior and task quality remain untested.
Installation and inspection
This command is recorded from the source ecosystem and resolves the registry's latest release. The fixed release shown on this page should be inspected before adoption.
clawhub install @dennisrongo/security-reviewclawhub inspect @dennisrongo/security-review --version 1.0.0Security evidence
SkillVetAI static result: no findings detected
This automated, non-executing scan is bound to this release hash. It is not a safety certification and may contain false positives or false negatives.
- Status
- completed
- Coverage
- full text content
- Files
- 2 / 2 inspected as text
- Checked
- 8/16/2026, 9:38:28 PM
- Scanner
- 0.1.3
- Policy
- 1.0.3
3 inferred permission indicators
- network access — automatically inferred
- filesystem write — automatically inferred
- credential access — automatically inferred
1 dependency and API indicators
- api: clawhub.ai
External clawhub result: clean
This is registry-supplied evidence for the recorded release, not an independent SkillVetAI scan. Check the canonical source for the full report, scanner versions, scope, and current moderation state.
- Evidence checked
- 8/16/2026, 8:58:00 PM
- Release binding
- Matches this record
- vt: clean
- skillspector: clean
- llm: clean
Recorded files
The catalog stores hashes and an inventory summary for change detection. It does not republish the package contents.
Package content hash
sha256:b1abf7ed9de48dbf99a916f43c1d3f87d5c5d09e90e5d2536619e65f2ad96537Show up to 2 recorded paths
skill-card.mdSKILL.md
Source changelog
- Major rewrite: The skill now focuses exclusively on attacker’s-eye security reviews of code diffs, branches, or modules, not external packages. - Scope clarified: Only triggers for explicit security review requests or when changes hit trust boundaries (auth, endpoints, sensitive paths). - Review process strictly catalogs classes of vulnerabilities (authz, injection, secrets, SSRF, path traversal, crypto misuse, dependency CVEs). - Every finding must state a concrete attack path (actor, action, impact) or is demoted to hardening advice. No speculative or padded findings. - Never claims "secure"—only "nothing found in these classes, on this evidence, here’s what wasn’t checked". All coverage/exclusions must be explicit. - Removed prior install-blocking workflow and package-focused review steps in favor of code-change threat modeling.