Claude Skills · Code Review & Testing
Review Security
Phelan164/codex-howtoReview application and infrastructure changes for exploitable security risks by tracing assets, trust boundaries, attacker-controlled input, authorization, sensitive data, and dangerous sinks. Use for security reviews, threat-focused PR reviews, authentication or authorization changes, input handling, secrets, dependencies, and infrastructure permissions; do not use to exploit live systems or modify code unless separately requested.
At a glance
This skill is for Code Review & Testing and helps you review security vulnerabilities in code changes, audit authentication and authorization logic, and assess infrastructure permission risks.
git clone --depth 1 https://github.com/Phelan164/codex-howto
cp -r codex-howto/skills/review-security ~/.claude/skills/review-security
Setup, runtime and requirements describe Phelan164/codex-howto, the repo this skill ships in.
Security ReviewThreat ModelauthorizationInput Validationsecrets-managementVulnerability Assessment
Also in Phelan164/codex-howto
View the repoBuild or modify backend APIs, services, jobs, persistence, and integrations while preserving contracts, authorization, data integrity, and f...
Build or modify frontend interfaces using repository-native components while preserving accessibility, responsive behavior, state handling,...
Drive an authorized repository change through a verified local loop: baseline, reproduce, implement, test, review, and report evidence. Use...
Maintain a review-first Markdown knowledge base for Codex practices with source provenance, engineering capture, citation-aware queries, exp...
Plan and implement infrastructure, CI/CD, container, deployment, observability, and operational configuration changes with least privilege,...
Coordinate complex engineering work across bounded subagents while protecting the main context, preventing edit conflicts, and measuring whe...
Review code changes for correctness defects, regressions, security risks, data-integrity problems, concurrency hazards, and missing meaningf...
Design, implement, and evaluate risk-based software tests across unit, integration, contract, end-to-end, and regression layers. Use when ad...
Other Code Review & Testing skills
Migrate test files from `as` type assertions to @total-typescript/shoehorn. Use when user mentions shoehorn, wants to replace `as` in tests,...
A relentless interview to sharpen a plan or design, which also creates docs (ADR's and glossary) as we go.
Move issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.
Create exercise directory structures with sections, problems, solutions, and explainers that pass linting. Use when user wants to scaffold e...
Use when you need to resolve an in-progress git merge/rebase conflict.
A relentless interview that asks every frontier question at once, round by round.