10 min read
Security and Review Skills
Security and review skills are the quality gates: strict diff review, threat modeling, deep security scans, CI repair, and no-sus cleanup. Source: Skill Registry, 2026-07-15
When To Use This
Use this family for code review, QA gates, no-sus checks, security scans, threat modeling, CI repair, doctor enforcement, SEO/audit quality gates, and adversarial review.
Core Model
Executable behavior lives in skills/**/SKILL.md. This page owns family-level routing, tradeoffs, and failure modes. Exhaustive inventory lives in Skill Registry. Full retired article bodies live in Retired Skill Article Ledger.
Concept Position
| Axis | Value |
|---|---|
| Family | Generated skill-family synthesis |
| Concept owned | Security and review skills are the quality gates: strict diff review, threat modeling, deep security scans, CI repair, and no-sus cleanup. |
| Operationalizes into | Skill Registry, Skill Resolver, executable SKILL.md source |
| Use this page when | choosing the right skill family before loading executable source |
Decision Matrix
| Need | Route |
|---|---|
| Run local doctors before broad review. | Load the named SKILL.md from Skill Registry and use this page for context. |
| Use threat model skills for auth/secrets/permissions. | Load the named SKILL.md from Skill Registry and use this page for context. |
| Use no-sus/autoreview/gstack in the configured order. | Load the named SKILL.md from Skill Registry and use this page for context. |
Do Not Confuse
- Implementation skills can fix findings but should not replace review.
- Browser QA belongs in browser-testing-skills unless the task is review policy.
Tool And Skill Routing
| Skill | Category | Origin | Executable source | Trigger signal |
|---|---|---|---|---|
| automate | productivity | cursor-plugin | skills/productivity/automate/SKILL.md | Create Cursor Automations through the interactive editor handoff. Use when the user explicitly asks to create, set up, draft, or open a new Cursor Automation, scheduled agent, Slack-trigg... |
| autoreview | engineering | personal | skills/engineering/autoreview/SKILL.md | Pre-commit/ship code review: Codex default; optional Claude, Pi, Droid, Copilot, Cursor, or OpenCode. |
| bugs | engineering | personal | skills/engineering/bugs/SKILL.md | CTF-style security and correctness audit. Dispatches parallel Opus subagents to hunt for day-0 bugs in security-critical files. Each agent must find a real bug or honestly admit failure.... |
| ci-integrity-audit | engineering | personal | skills/engineering/ci-integrity-audit/SKILL.md | Audit CI-related changes across one or more PRs to prove a green build was EARNED, not gamed. Use after getting a batch of PRs green, before merging a stack, or whenever you suppressed a... |
| counterfactual | engineering | personal | skills/engineering/counterfactual/SKILL.md | Compare the current implementation against the minimal correct algorithm. Use when debugging regressions, reviewing complex fixes, or when the user asks what should happen versus what is... |
| cross-modal-review | engineering | personal | skills/engineering/cross-modal-review/SKILL.md | Quality gate via a second AI model. Spawn a different model to review work before committing. Grades against the originating skill's Contract. Use when you want a second opinion from a di... |
| deepsec | engineering | personal | skills/engineering/deepsec/SKILL.md | Run vercel-labs/deepsec — an agent-powered vulnerability scanner — against any local codebase. Use when Kevin says "deepsec", "security scan", "scan this repo for vulns", "find security b... |
| doctor-enforcement | engineering | personal | skills/engineering/doctor-enforcement/SKILL.md | Auto-run the relevant codebase doctor(s) after large edit sessions or before committing. Detects which subsystems were touched and runs the matching doctor or security doctor chain. Use w... |
| ensure-repo-license | engineering | personal | skills/engineering/ensure-repo-license/SKILL.md | Ensure Kevin's open-source repos ship with an MIT LICENSE before publish or on audit. Use when creating a new public repo, open-sourcing a project, publishing to npm/GitHub, Kevin says "a... |
| excalidraw-diagram-generator | engineering | personal | skills/engineering/excalidraw-diagram-generator/SKILL.md | Generate Excalidraw diagrams from natural language descriptions. Use when asked to "create a diagram", "make a flowchart", "visualize a process", "draw a system architecture", "create a m... |
| exemplar-audit | engineering | dedalus | skills/engineering/exemplar-audit/SKILL.md | Compare implementation against canonical open-source references. Clone exemplars into /tmp, diff edge cases, error paths, and protocol invariants. Use when building a new subsystem, after... |
| fail-closed-case-matching | engineering | dedalus | skills/engineering/fail-closed-case-matching/SKILL.md | Dedalus philosophy on conditional logic, error paths, and why we never write fallbacks. Use when writing or reviewing any branching logic that selects between strategies, modes, or error-... |
| gh-fix-ci | engineering | personal | skills/engineering/gh-fix-ci/SKILL.md | Use when a user asks to debug or fix failing GitHub PR checks that run in GitHub Actions; use gh to inspect checks and logs, summarize failure context, draft a fix plan, and implement o... |
| go-style | engineering | dedalus | skills/engineering/go-style/SKILL.md | Complete Go style reference for Dedalus. Loads the full guide, decisions, and best practices documents (~7000 lines). Use when writing, reviewing, or refactoring Go code and the rules fil... |
| graphify-sidecar | engineering | unknown | skills/engineering/graphify-sidecar/SKILL.md | Safe Graphify sidecar workflow for repo architecture graphs, repo topology, "what touches what", project onboarding, focused subgraph queries, path/explain questions, PR and risk analysis... |
| gstack-review | engineering | personal | skills/engineering/gstack-review/SKILL.md | Staff-engineer code review. Finds bugs that pass CI but blow up in production. Auto-fixes the obvious ones. Flags completeness gaps. Use when the user says "code review", "review this", "... |
| last30days | personal | unknown | skills/personal/last30days/skills/last30days/SKILL.md | Research what people actually say about any topic in the last 30 days. Pulls posts and engagement from Reddit, X, YouTube, TikTok, Hacker News, Polymarket, GitHub, and the web. Includes a... |
| loopy | productivity | personal | skills/productivity/loopy/SKILL.md | Craft, audit, adapt, run, and debrief bounded agent loops using Forward-Future/loopy and Kevin's no-one-off workflow. Use when the user says "use loopy", "craft loop skills", "make a loop... |
| no-sus-code-doctor | engineering | personal | skills/engineering/no-sus-code-doctor/SKILL.md | Run a strict Dedalus STYLE-informed code-quality doctor for agent-authored PRs. Use when Kevin says "no sus code", "strict review", "quality doctor", "get this to 100", "prove this works"... |
| pnpm | engineering | skills-sh | skills/engineering/pnpm/SKILL.md | Node.js package manager with strict dependency resolution. Use when running pnpm specific commands, configuring workspaces via pnpm-workspace.yaml, or managing dependencies with catalogs,... |
| pr-review | engineering | dedalus | skills/engineering/pr-review/SKILL.md | Review PR comments from GitHub. Fetches inline review comments and issue comments, classifies by review.md prefix semantics (blocking vs non-blocking), and summarizes actionable items. Us... |
| project-briefing | engineering | personal | skills/engineering/project-briefing/SKILL.md | Generate an executive briefing of the last 24 hours of commits for the current project or a specified directory. Use when the user asks for a project update, daily briefing, commit summar... |
| react-doctor | engineering | personal | skills/engineering/react-doctor/SKILL.md | Run React Doctor and React Security Doctor on React, Next.js, Vite, or React Native codebases. Use when Kevin says "react doctor", "React Security Doctor", "score React to 100", "fix bad... |
| read-and-review | engineering | dedalus | skills/engineering/read-and-review/SKILL.md | Read external reference material (RFDs, papers, blog posts, docs), extract actionable rules, then dispatch subagents to audit the codebase against those rules and fix violations. Use when... |
| red-team-business | productivity | personal | skills/productivity/red-team-business/SKILL.md | Adversarially audit a business, product, launch, pricing page, or project plan. Use when Kevin asks to red-team an idea, attack a business, find blind spots, run a premortem, simulate com... |
| review | engineering | cursor-plugin | skills/engineering/review/SKILL.md | Route a Cursor code-review request to the Bugbot or Security Review subagent. Use when the user invokes /review, asks for Cursor Bugbot, asks for a Cursor Security Review, or wants the bu... |
| review-bugbot | engineering | cursor-plugin | skills/engineering/review-bugbot/SKILL.md | Run the Cursor Bugbot readonly subagent on branch changes, uncommitted changes, or a described diff. Use when the user invokes /review-bugbot, asks Bugbot to review code, or wants Cursor'... |
| review-security | engineering | cursor-plugin | skills/engineering/review-security/SKILL.md | Run the Cursor Security Review readonly subagent on branch changes or uncommitted changes. Use when the user invokes /review-security, asks for Cursor's security review, or wants the buil... |
| rust | engineering | personal | skills/engineering/rust/SKILL.md | Use for Rust work: async patterns, ownership and borrowing issues, production Rust style, tests, performance, safety, and low-level systems code review. Load folded Rust references for de... |
| security-best-practices | engineering | personal | skills/engineering/security-best-practices/SKILL.md | Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a securit... |
| security-doctor-chain | engineering | personal | skills/engineering/security-doctor-chain/SKILL.md | Orchestrate Kevin's security/pre-ship doctor chain across React Security Doctor, deepsec, threat modeling, secure-coding review, adversarial bug hunts, vibe-code-doctor, and no-sus-code-d... |
| security-threat-model | engineering | personal | skills/engineering/security-threat-model/SKILL.md | Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only... |
| shell | engineering | personal | skills/engineering/shell/SKILL.md | Runs the rest of a /shell request as a literal shell command. Use only when the user explicitly invokes /shell and wants the following text executed directly in the terminal. |
| simple-diagnosis-template | engineering | personal | skills/engineering/simple-diagnosis-template/SKILL.md | Frame any technical answer as a reproducible five-part diagnosis. Use when the user asks for a root-cause explanation, a fix proposal, a debugging write-up, or says "explain why", "what's... |
| skill-audit | engineering | personal | skills/engineering/skill-audit/SKILL.md | Scan recent Cursor agent transcripts and update or create category skills based on recurring patterns, struggles, or inefficiencies. Use when asked to audit skills, improve automations, r... |
| skill-auditor | engineering | personal | skills/engineering/skill-auditor/SKILL.md | Security auditor for agent skills. Run before installing any new skill from skills.sh, GitHub, or any source. 6-step vetting protocol covering typosquatting, permissions, dependencies, pr... |
| split-to-prs | engineering | personal | skills/engineering/split-to-prs/SKILL.md | Split current work into small reviewable PRs. Use when the user asks to split a chat, set of changes, branch, or PR. |
| style-guide | engineering | dedalus | skills/engineering/style-guide/SKILL.md | Dedalus style guide quick reference. Key rules for writing code that lasts. Use when writing or reviewing Python code. |
| template-creator | misc | codex-plugin | skills/misc/template-creator/SKILL.md | Create or update a reusable personal Codex artifact-template skill. Use when the user invokes $template-creator or asks in natural language to create a template using, from, or based on a... |
| ultracite | engineering | personal | skills/engineering/ultracite/SKILL.md | Zero-config linting and formatting via Ultracite (oxlint/oxfmt, Biome, or ESLint). Use when bootstrapping a new project, adding linting to an existing app, configuring agent hooks, settin... |
| vibe-code-doctor | engineering | personal | skills/engineering/vibe-code-doctor/SKILL.md | Audit a vibe-coded project for the failure modes that make it collapse in production, score it 0-100, and drive fixes. Use when the user says "vibe code doctor", "is this vibe-coded proje... |
Failure Modes
- Reviewing summaries before findings.
- Letting lint/build pass masquerade as a doctor score.
- Skipping proof for security changes.
Timeline
- 2026-07-15 | Regenerated this concise family synthesis page from Skill Registry after archiving verbose retired skill-article bodies to Retired Skill Article Ledger. Source: User request, 2026-06-27
- 2026-07-15 | Concepts category refresh linked this generated family page to Concept System Map and kept it generated because executable skill source owns the procedure details. Source: User request, 2026-07-01
Related Pages
236 pages link here
Actionable Tools IndexToolsActive Stack (What to Actually Use)MetaAdversarial Self-Audit PromptsConceptsAgent Capability RegistryConceptsAgent Company OSArchitectureAgent Cookie - Session State Sync for the Agent's Second MacToolsAgent EthosConceptsAgent ExpectationsUSERAgent Harness CapsulesConceptsAgent LoopingConceptsAgent Operating SystemArchitectureAgent Search and RetrievalConceptsAgent Skill BundlesConceptsAgent SoulSOULAgent-Docs MeshConceptsAgentic Quality SystemConceptsAlgorithmic Slop Throttling (Posting for the X Algorithm)ConceptsAlgrow YouTube SearchToolsAndrej Karpathy's LLM Coding SkillsToolsApplication Standout ProtocolCareerautomateSkillsAutoResearch (Karpathy) - Applied to MarketingToolsautoreviewSkillsAWS Agent ToolkitToolsAWS EcosystemToolsBlacksmith GitHub ActionsToolsBrain CapsulesMetaBrain-First LookupDecisionsBrowser to APIToolsbugsSkillsBuilding in PublicStoriesCapability Harvest PatternMetaCapability Routing MapMetaCapture Ingest WorkflowWorkflowsCareer Content RoutingSkill Resolverci-integrity-auditSkillsClaude Code /goal CommandToolsClaude Code HarnessArchitectureClickHouse EcosystemToolsClipping as Distribution StrategyConceptsCloudflare /crawl EndpointToolsCloudflare EcosystemToolsCnfastToolsCode Bugfix WorkflowWorkflowsCode Review GraphToolsCode Review RoutingSkill ResolverCode TasteStyleComment StyleStyleCommunication PreferencesUSERConcept System MapConceptsConductor Programming Interview PrepInterview PrepContent BacklogCareerContent Backlog ProtocolHEARTBEATContent Pipeline WorkflowWorkflowsContent Plan Archive, April–May 2026CareercounterfactualSkillsCrabboxToolscross-modal-reviewSkillsCSS UI EnforcementStyleCursor /thermo-nuclear-code-quality-reviewToolsCursor Orchestrate SkillToolsCursor SDKToolsCursor Team KitToolsDaily Work Summary WorkflowWorkflowsDatadog EcosystemToolsDedalus E2E Tiered TestingWorkflowsDedalus Machines - Positioning & PitchProjectsdeepsecSkillsDeepsec - Agent-Powered Vulnerability ScannerToolsDefuddle - Web Content ExtractionToolsDesign Inspiration GalleriesDesignDoctor PatternConceptsdoctor-enforcementSkillsDual-Audience ErrorsConceptsE2B Code SandboxesToolsECR Lifecycle Mass DeletionPostmortemsEmail Inbound TrackerCareerEmpirical VerificationConceptsEngineering QualitySOULensure-repo-licenseSkillsEverything Claude Code - Agent Harness Performance SystemToolsExa AgentToolsexcalidraw-diagram-generatorSkillsexemplar-auditSkillsFactory AutoWikiToolsfail-closed-case-matchingSkillsFirecrawl MonitoringToolsGEO-SEO-ClaudeToolsGEPA - Genetic-Pareto Skill EvolutionConceptsgh-fix-ciSkillsGitHub EcosystemToolsGitHub RoutingSkill ResolverGitHub Starred Repos Harvest - 2026-06-26ResearchGitHub Starred Repos Harvest - 2026-06-28ResearchGo StyleStylego-styleSkillsGoogle Workspace CLIToolsGPT-5-CodexToolsgraphify-sidecarSkillsGraphite - AI Code ReviewToolsgstack-reviewSkillsHand-Drawn DiagramsToolsHarkProjectsHark App-Building Interview PrepInterview PrepHark Live SidepanelInterview PrepHermes Mac Mini Agent OSArchitectureHiggsfield MCPToolsInvariant-First TestingConceptsIs This Tech Dead?ToolsJam (SpreadJam)ToolsLangExtractToolsLast 30 Days - Multi-Platform Research EngineToolslast30daysSkillsLaunch Agent System (Matt Epstein)ToolsLaunch Post PlaybookCareerLinear EcosystemToolsLLM Synthetic Panels (Purchase Intent)ConceptsloopySkillsLunoraToolsMarkItDown - Universal File-to-Markdown ConverterToolsMatt PocockPeopleMatt Pocock's Skills (Skills for Real Engineers)ToolsMatt Van HornPeopleMinerUToolsMoneyPrinterTurboToolsNext.jsToolsNo One-Off WorkPhilosophiesNo-Fallbacks PolicyConceptsno-sus-code-doctorSkillsNotFair (SEO and Ads Claude Skills)ToolsNVIDIA SkillSpectorToolsOpenClaw Agent SkillsToolsOpenClaw HarnessArchitectureOpenUI -- Generative UI Language and RuntimeToolsOperational HeartbeatHEARTBEATOperational RoutingSkill ResolverOverlayfs Block-Copy (M10)ArchitecturePeople Page Voice StyleStylePersonal Skills TaxonomyAgent DocsPeter SteinbergerPeoplePlan Mode Review ChecklistConceptspnpmSkillsPonytailToolspr-reviewSkillsPrinting Press - Agent-Native CLIs from a Single PromptToolsProduction DebuggingUSERProject Briefing CadenceHEARTBEATProject Briefing WorkflowWorkflowsProject GlasswingToolsproject-briefingSkillsProof LoopSOULPython StyleStyleQMD - Local Wiki Search EngineToolsQuality GatesMetaQuality Review StackToolsRadar Registration GateArchitectureRadarSignUpBridge Metadata Sync InvestigationPostmortemsReact DoctorToolsreact-doctorSkillsread-and-reviewSkillsReClip - Self-Hosted Video DownloaderToolsred-team-businessSkillsReflection and Self-Critique Agent ArchitectureArchitectureRemotion + Claude Code Marketing DemosWorkflowsResearch RoutingSkill ResolverResume, Kevin B. LiuCareerRetired Skill Article LedgerMetareviewSkillsreview-bugbotSkillsreview-securitySkillsRoboflow SupervisionToolsrustSkillsSecurity RoutingSkill ResolverSecurity Scan WorkflowWorkflowssecurity-best-practicesSkillssecurity-doctor-chainSkillssecurity-threat-modelSkillsSelf-Maintaining SystemsConceptsSentry EcosystemToolsSEO GEO Radar WorkflowWorkflowsSEO/GEO Evaluation ChecklistConceptsSEO/GEO/AEO/AX ImplementationArchitectureService CLI CoverageToolsshadcn/improveToolsshellSkillsSherlockToolsSignal Radar CadenceHEARTBEATSignal Radar WorkflowWorkflowssimple-diagnosis-templateSkillsSkill RegistryMetaSkill ResolverSkill ResolverSkill Sync WorkflowWorkflowsskill-auditSkillsskill-auditorSkillsSkills-First EnforcementDecisionsSkills, Tools, and Capability DiscoveryConceptsSlack EcosystemToolsSlash Command IndexMetaSocial Content OSToolsSpawn AgentToolssplit-to-prsSkillsStaying in the Loop with AgentsConceptsStop SlopToolsStripe EcosystemToolsStyle FilingFiling Decision Treestyle-guideSkillsSupabase EcosystemToolsSupabase RoutingSkill ResolverSupabase TanStack DBToolsTakumiToolsTaste Skill Framework (Leonxlnx/taste-skill)Toolstemplate-creatorSkillsTerraform StyleStyleThe 7 Phases of AI-Powered DevelopmentWorkflowsThe Eval Loop (Slop Is an Output Problem)ConceptsThird-Party Noise SuppressionConceptsTool Hierarchy CompactAgent DocsTransitions.devToolsUI Skills PackToolsultraciteSkillsUser ProfileUSERVercel Agent SkillsToolsVercel BlobToolsVercel EcosystemToolsvibe-code-doctorSkillsVibecoding CritiqueConceptsVibeVoiceToolsWiki Redirect IndexMetaX Bookmark Ingest 2026-06-28ResearchX Bookmarks: AI Agents & Tools (Jan 2025 – Jun 2026)ToolsX Bookmarks: Dev Tools (Mar–Jun 2026)ToolsX Bookmarks: React & Next.js (Mar–Jun 2026)ToolsX For You Algorithm (2026 Open Source)ArchitectureX MCPToolsX-AgentProjectsZero Tech DebtTools