Security and Review Skills

Security and review skills are the quality gates: strict diff review, threat modeling, deep security scans, CI repair, and no-sus cleanup. Source: Skill Registry, 2026-11-02

When To Use This

Use this family for code review, QA gates, no-sus checks, security scans, threat modeling, CI repair, doctor enforcement, SEO/audit quality gates, and adversarial review.

Core Model

Executable behavior lives in skills/**/SKILL.md. This page owns family-level routing, tradeoffs, and failure modes. Exhaustive inventory lives in Skill Registry. Full retired article bodies live in Retired Skill Article Ledger.

Concept Position

Axis	Value
Family	Generated skill-family synthesis
Concept owned	Security and review skills are the quality gates: strict diff review, threat modeling, deep security scans, CI repair, and no-sus cleanup.
Operationalizes into	Skill Registry, Skill Resolver, executable `SKILL.md` source
Use this page when	choosing the right skill family before loading executable source

Decision Matrix

Need	Route
Run local doctors before broad review.	Load the named SKILL.md from Skill Registry and use this page for context.
Use threat model skills for auth/secrets/permissions.	Load the named SKILL.md from Skill Registry and use this page for context.
Use no-sus/autoreview/gstack in the configured order.	Load the named SKILL.md from Skill Registry and use this page for context.

Do Not Confuse

Implementation skills can fix findings but should not replace review.
Browser QA belongs in browser-testing-skills unless the task is review policy.

Tool And Skill Routing

Skill	Category	Origin	Executable source	Trigger signal
ascii-texture-grounds	engineering	personal	skills/engineering/ascii-texture-grounds/SKILL.md	Build full-bleed interactive grounds from glyphs, dither cells or word tiles that hold 60 fps and cost nothing idle: ASCII fields, logo reveal fields, Bayer and halftone dither, tile wall...
automate	deprecated	cursor-plugin	skills/deprecated/automate/SKILL.md	Create Cursor Automations through the interactive editor handoff. Use when the user explicitly asks to create, set up, draft, or open a new Cursor Automation, scheduled agent, Slack-trigg...
autoreview	engineering	personal	skills/engineering/autoreview/SKILL.md	Review code before a commit or ship: a second-model review (Codex or Claude), a bug pass, a strict self-audit to 100, an adversarial bug hunt, or an audit against a document. Use when ask...
better-colors	engineering	unknown	skills/engineering/better-colors/SKILL.md	Builds and checks color systems by generating palettes, naming semantic tokens, converting between formats and measuring contrast. Use when choosing or reviewing colors, tokens or contrast.
better-layout	engineering	unknown	skills/engineering/better-layout/SKILL.md	Sets grouping, alignment, reading order, responsive structure and room for translated text, so a layout holds up when it is resized, translated or mirrored. Use when building or reviewing...
better-typography	engineering	unknown	skills/engineering/better-typography/SKILL.md	Sets and reviews how text renders, from the type scale and spacing to font features, wrapping, truncation and punctuation. Use when choosing type or fixing how text looks in a UI.
cad-viewer	engineering	external	skills/engineering/cad-viewer/SKILL.md	Start CAD Viewer and return review links for `.step`, `.stp`, `.stl`, `.3mf`, `.glb`, `.dxf`, `.implicit.js`, `.implicit.mjs`, `.urdf`, `.srdf` and `.sdf` files. Use when visually reviewi...
ci-integrity-audit	engineering	personal	skills/engineering/ci-integrity-audit/SKILL.md	Audit CI changes across PRs to prove a green build was earned: lint-disables, ts-ignore, skipped or deleted tests, threshold bumps, gate edits, swallowed failures and retries, with file:l...
counterfactual	engineering	personal	skills/engineering/counterfactual/SKILL.md	Compare the current implementation against the minimal correct algorithm. Use when debugging regressions, reviewing complex fixes, or when the user asks what should happen versus what is...
deepsec	engineering	personal	skills/engineering/deepsec/SKILL.md	Run vercel-labs/deepsec, an agent-powered vulnerability scanner, on a local codebase, with a --limit 50 calibration before any full scan. Use when Kevin says "deepsec", "security scan" or...
doctor-enforcement	engineering	personal	skills/engineering/doctor-enforcement/SKILL.md	Run the matching codebase doctors or security doctor chain for the subsystems an edit touched. Use after editing 5+ files, before claiming done or committing, or on "run doctors", "health...
ensure-repo-license	engineering	personal	skills/engineering/ensure-repo-license/SKILL.md	Ensure Kevin's open-source repos ship an MIT LICENSE, auditing and applying it with scripts/ensure-mit-license.ts. Use when creating or open-sourcing a public repo, publishing to npm or G...
excalidraw-diagram-generator	engineering	personal	skills/engineering/excalidraw-diagram-generator/SKILL.md	Generate Excalidraw diagrams (flowcharts, architecture, mind maps, relationship diagrams) as .excalidraw files with PNG or SVG previews. Use when asked to create a diagram, flowchart or m...
exemplar-audit	engineering	dedalus	skills/engineering/exemplar-audit/SKILL.md	Compare an implementation against canonical open-source references cloned into /tmp, diffing edge cases, error paths and protocol invariants. Use when building a subsystem, after a refact...
gh-fix-ci	engineering	personal	skills/engineering/gh-fix-ci/SKILL.md	Debug failing GitHub Actions PR checks with `gh`: read checks and logs, summarize the failure, draft a fix plan, and implement only after explicit approval. Use when a PR's checks fail. B...
go-style	deprecated	dedalus	skills/deprecated/go-style/SKILL.md	Complete Go style reference for Dedalus. Loads the full guide, decisions, and best practices documents (~7000 lines). Use when writing, reviewing, or refactoring Go code and the rules fil...
last30days	personal	unknown	skills/personal/last30days/skills/last30days/SKILL.md	Research what people actually say about any topic in the last 30 days. Pulls posts and engagement from Reddit, X, YouTube, TikTok, Hacker News, Polymarket, GitHub, and the web. Includes a...
loopy	productivity	personal	skills/productivity/loopy/SKILL.md	Craft, audit, adapt, run and debrief bounded agent loops with Forward-Future/loopy and Kevin's no-one-off workflow. Use when the user says "use loopy", "make a loop", "run this loop" or "...
pnpm	engineering	skills-sh	skills/engineering/pnpm/SKILL.md	Manage Node.js dependencies with pnpm and its strict resolution. Use when running pnpm commands, configuring pnpm-workspace.yaml, or managing catalogs, patches, overrides, config dependen...
pr-review	deprecated	dedalus	skills/deprecated/pr-review/SKILL.md	Review PR comments from GitHub. Fetches inline review comments and issue comments, classifies by review.md prefix semantics (blocking vs non-blocking), and summarizes actionable items. Us...
react-doctor	engineering	personal	skills/engineering/react-doctor/SKILL.md	Run React Doctor and React Security Doctor on React, Next.js, Vite or React Native codebases. Use when Kevin says "react doctor", "score React to 100", "fix bad React" or "scan React secu...
red-team-business	productivity	personal	skills/productivity/red-team-business/SKILL.md	Adversarially audit a business, product, launch, pricing page or plan. Use when Kevin asks to red-team an idea, find blind spots, run a premortem, simulate competitors, customers or inves...
review	deprecated	cursor-plugin	skills/deprecated/review/SKILL.md	Route a Cursor code-review request to the Bugbot or Security Review subagent. Use when the user invokes /review, asks for Cursor Bugbot, asks for a Cursor Security Review, or wants the bu...
review-bugbot	deprecated	cursor-plugin	skills/deprecated/review-bugbot/SKILL.md	Run the Cursor Bugbot readonly subagent on branch changes, uncommitted changes, or a described diff. Use when the user invokes /review-bugbot, asks Bugbot to review code, or wants Cursor'...
review-security	deprecated	cursor-plugin	skills/deprecated/review-security/SKILL.md	Run the Cursor Security Review readonly subagent on branch changes or uncommitted changes. Use when the user invokes /review-security, asks for Cursor's security review, or wants the buil...
rust	engineering	personal	skills/engineering/rust/SKILL.md	Use for Rust work: async patterns, ownership and borrowing issues, production Rust style, tests, performance, safety, and low-level systems code review. Load folded Rust references for de...
security-best-practices	engineering	personal	skills/engineering/security-best-practices/SKILL.md	Review Python, JavaScript/TypeScript or Go code against language and framework security best practices. Use only when the user explicitly asks for security guidance, a security review or...
security-doctor-chain	engineering	personal	skills/engineering/security-doctor-chain/SKILL.md	Chain Kevin's pre-ship security doctors: React Security Doctor, deepsec, threat modeling, secure-coding review, bug hunts, vibe-code-doctor and autoreview's self-audit. Use when hardening...
security-threat-model	engineering	personal	skills/engineering/security-threat-model/SKILL.md	Write a repository-grounded threat model in Markdown: trust boundaries, assets, attacker capabilities, abuse paths, mitigations. Use only when the user explicitly asks to threat model a c...
shell	engineering	personal	skills/engineering/shell/SKILL.md	Runs the rest of a /shell request as a literal shell command. Use only when the user explicitly invokes /shell and wants the following text executed directly in the terminal.
simple-diagnosis-template	deprecated	personal	skills/deprecated/simple-diagnosis-template/SKILL.md	Frame any technical answer as a reproducible five-part diagnosis. Use when the user asks for a root-cause explanation, a fix proposal, a debugging write-up, or says "explain why", "what's...
skill-audit	deprecated	personal	skills/deprecated/skill-audit/SKILL.md	Scan recent Cursor agent transcripts and update or create category skills based on recurring patterns, struggles, or inefficiencies. Use when asked to audit skills, improve automations, r...
skill-auditor	engineering	personal	skills/engineering/skill-auditor/SKILL.md	Vet an agent skill with a 6-step security check: typosquatting, permissions, dependencies, prompt injection, network exfiltration and red flags. Must run before any skill install, on "npx...
split-to-prs	engineering	personal	skills/engineering/split-to-prs/SKILL.md	Split current work into small reviewable PRs. Use when the user asks to split a chat, set of changes, branch, or PR.
style-guide	deprecated	dedalus	skills/deprecated/style-guide/SKILL.md	Dedalus style guide quick reference. Key rules for writing code that lasts. Use when writing or reviewing Python code.
ultracite	engineering	personal	skills/engineering/ultracite/SKILL.md	Set up zero-config linting and formatting with Ultracite (oxlint and oxfmt, Biome or ESLint), agent hooks and CI checks, over hand-rolled configs. Use when bootstrapping a project, adding...
vibe-code-doctor	engineering	personal	skills/engineering/vibe-code-doctor/SKILL.md	Audit a vibe-coded or AI-generated project for production failure modes, score it 0 to 100 and drive fixes in comprehension, integration, architecture and ops. Use on "vibe code doctor",...
wayfinder	engineering	personal	skills/engineering/wayfinder/SKILL.md	Plan work too large or uncertain for one agent session as a durable map of decision tickets, blocking edges, a visible frontier, and fog of war. Invoke manually with /wayfinder when the r...

Failure Modes

Reviewing summaries before findings.
Letting lint/build pass masquerade as a doctor score.
Skipping proof for security changes.

Timeline

2026-11-02 | Regenerated this concise family synthesis page from Skill Registry after archiving verbose retired skill-article bodies to Retired Skill Article Ledger. private page
2026-11-02 | Concepts category refresh linked this generated family page to Concept System Map and kept it generated because executable skill source owns the procedure details. private page