Review authorized application code, configuration, designs or artifacts for concrete authorization, data exposure, injection, secret, dependency and LLM/tool security risks. Use for a requested security review or a change affecting a trust boundary.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Security Review
Load the review method; use Research when dependency/advisory claims need current evidence. Reuse existing fix/testing authority; review alone adds no remediation or live-exploitation authority.
```mermaid
flowchart LR
R[Code Review method] -->|Current dependency / advisory evidence| D[Research]
click R "../code-review/references/review.md"
click D "../research/SKILL.md"
```
- Trace = sensitive asset + caller/input + required permission → actual enforcing owner → operation/data. UI visibility or a caller's check does not prove server authorization.
- Coverage = focused change → affected path + adjacent callers; broad review → actual entry points + assets, then relevant surfaces below. Mark material missing evidence.
| Surface | Resolve |
|---|---|
| Identity / sessions | Caller-selected identity, role or tenant; login, recovery, expiry + revocation boundaries. |
| Data / privilege | Actor + tenant enforcement for object, field, list/export + mutation; alternate entry points. |
| Input / files | Query, markup, URL, path, upload/archive → normalization + downstream parser, fetch, storage or execution. |
…
The line at the top of this page pins the label git:20260928.259bd6c, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
GET https://markdownregistry.com/api/v1/artifacts/art_eecps2dkt26lu76x
GET https://markdownregistry.com/api/v1/resolve?ref=sgaabdu4/building-flutter-apps/security-review
GET https://markdownregistry.com/api/v1/blob/f9d62367226f0f06a7f95a05fabf85aee617871664d8c215948b6235f62d8361
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
sgaabdu4/building-flutter-apps · .agents/skills/building-flutter-apps/SKILL.md · Flutter Riverpod app architecture and Windows installer delivery. Use before changing a Riverpod Flutter app/package or…
sgaabdu4/building-flutter-apps · .agents/skills/code-review/SKILL.md · Review PR, branch, commit or working-tree changes for concrete defects and fidelity to intended behavior. Also use when…
sgaabdu4/building-flutter-apps · .agents/skills/codebase-design/SKILL.md · Design or review module ownership, public interfaces and abstractions; UI token/component ownership; or domain-driven…
sgaabdu4/building-flutter-apps · .agents/skills/e2e/SKILL.md · Prove real user journeys across browser, mobile, desktop, API and CLI surfaces using the project's existing test tools…
sgaabdu4/building-flutter-apps · .agents/skills/he-build/SKILL.md · Implement and verify a ready, authorized plan through focused fixes and integrated checks, ending with a ready-for-ship…
sgaabdu4/building-flutter-apps · .agents/skills/he-learn/SKILL.md · Prevent verified repeated failures and preserve lasting decisions in terse ADRs. Use when failures recur, prevention…
sgaabdu4/building-flutter-apps · .agents/skills/he-plan/SKILL.md · Plan a change before implementation, resolve material user decisions and prepare repository-grounded UX references. Use…
sgaabdu4/building-flutter-apps · .agents/skills/he-ship/SKILL.md · Deliver a verified build through a task branch and PR, check the intended remote result, and clean up the completed…
sgaabdu4/building-flutter-apps · .agents/skills/he/SKILL.md · Apply Hard Eng's planning, project context, verification and gate-adaptation guidance when implementing or reviewing…
sgaabdu4/building-flutter-apps · .agents/skills/marketing-video/SKILL.md · Make a voiced product marketing or explainer video from real product screens. Script, cut walkthrough clips or stage…
sgaabdu4/building-flutter-apps · .agents/skills/product-walkthrough-video/SKILL.md · Record and check real web journeys for E2E proof or polished walkthrough delivery. Reuse one recorder and…
affaan-m/ecc · .agents/skills/security-review/SKILL.md · Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or…
affaan-m/ecc · .kiro/skills/security-review/SKILL.md · Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or…
affaan-m/ecc · docs/es/skills/security-review/SKILL.md · Usar este skill al agregar autenticación, manejar entradas de usuario, trabajar con secretos, crear endpoints de API o…
microsoft/power-platform-skills · plugins/power-pages/skills/security-review/SKILL.md · Runs a guided, end-to-end security review of a Power Pages site and consolidates every finding into one HTML report…
kklimuk/docx-cli · .claude/skills/security-review/SKILL.md · Review code for security vulnerabilities. Use when the user says 'security review', 'security audit', 'check for…
