security-review · diff
git:20260309.0aecf29 to git:20260905.d98c025
31 added, 24 removed. Audit A to A.
---
name: security-review
- description: "Security review via Codex MCP. Use when: OWASP Top 10 audit, dependency vulnerability check, security-sensitive changes. Not for: code review (use codex-code-review), test review (use test-review). Output: security findings + audit report."
- allowed-tools: mcp__codex__codex, mcp__codex__codex-reply, Bash(git:*), Read, Grep, Glob
+ description: "Security review via Codex exec. Use when: OWASP Top 10:2025 audit, dependency vulnerability check, security-sensitive changes. Not for: code review (use codex-code-review), test review (use test-review). Output: security findings + audit report."
+ allowed-tools: Bash(git:*), Read, Grep, Glob, Bash(node:*), Write
context: fork
agent: Explore
---
# Security Review Skill
## Trigger
- Keywords: security review, OWASP, vulnerability, dep-audit, npm audit, dependency security
## When NOT to Use
- General code review (use `codex-code-review`)
- Functional testing (use `test-review`)
- Performance issues (not security-related)
## Commands
| Command | Purpose | When |
| ----------------- | ------------------------ | ----------------------- |
| `/codex-security` | OWASP Top 10 audit | Security-sensitive code |
| `/dep-audit` | Dependency security audit | Periodic / PR |
## Workflow: `/codex-security`
```
Determine scope → Collect changes → Codex OWASP review → Findings + Gate → Loop if Must fix
```
### Step 1: Determine Scope
Parse `--scope` from arguments, default to `src/`.
- ### Step 2: Collect Code Changes
+ ### Step 2: Collect Change **Metadata**
- Priority order:
- 1. Uncommitted changes: `git diff HEAD -- <scope> | head -1500`
- 2. Recent commits: `git diff HEAD~5..HEAD -- <scope> | head -1500`
- 3. Key security files: `Glob("**/*{auth,login,password,token,secret,key,credential}*")`
+ Metadata, not content: the first dispatch carries the changed-file list and diff stats, and Codex
+ reads the diffs itself from the sandbox (`@rules/codex-invocation.md` § Required in every first-dispatch prompt). A truncated
+ `| head -1500` excerpt was the old shape, and it decided for the reviewer which 1500 lines of a
+ security review mattered.
- ### Step 3: Codex Security Review
+ 1. `CHANGED_FILES`: `git diff --name-only HEAD -- <scope>` ∪ `git ls-files --others --exclude-standard -- <scope>`
+ 2. `DIFF_STAT`: `git diff --stat HEAD -- <scope>`
+ 3. `SCOPE`: the resolved scope argument, plus the security-relevant paths a
+ `Glob("**/*{auth,login,password,token,secret,key,credential}*")` surfaces — named as places to
+ look, never pasted
- **First review**: `mcp__codex__codex` with OWASP prompt. See `references/codex-prompt-security.md`.
+ ### Step 3: Codex Security Review
- Config: `sandbox: 'read-only'`, `approval-policy: 'never'`
+ **First review**: dispatch per `@skills/codex-code-review/references/codex-transport.md` § Start with the OWASP prompt. See `references/codex-prompt-security.md`.
**Save the returned `threadId`.**
- **Loop review**: `mcp__codex__codex-reply` with re-review template. See `references/codex-prompt-security.md`.
+ **Loop review**: dispatch per `@skills/codex-code-review/references/codex-transport.md` § Resume with the re-review template. See `references/codex-prompt-security.md`.
### Step 4: Consolidate Output
Organize results into findings summary table + detailed findings + gate.
- ## OWASP Top 10
+ ## OWASP Top 10:2025
- | Code | Category | Check Focus |
- | ---- | ------------------ | ------------------------------------ |
- | A01 | Broken Access Ctrl | IDOR, permission bypass, CORS |
- | A02 | Crypto Failures | Sensitive data encryption, weak crypto |
- | A03 | Injection | SQL/NoSQL/Cmd Injection |
- | A04 | Insecure Design | Rate Limiting, business logic |
- | A05 | Misconfiguration | Debug mode, default passwords |
- | A06 | Vulnerable Comp | Known vulnerable dependencies |
- | A07 | Auth Failures | Brute force, session, weak passwords |
- | A08 | Integrity Failures | Deserialization, CI/CD |
- | A09 | Logging Failures | Sensitive data in logs, auditing |
- | A10 | SSRF | URL validation, internal network access |
+ The version is part of the identifier: SSRF is no longer A10 (it sits inside A01), and A02–A06
+ renumbered, so a finding labelled with a 2021 code says something different to whoever reads it.
+
+ | Code | Category | Check Focus |
+ | ---- | ----------------------- | ---------------------------------------- |
+ | A01 | Broken Access Ctrl | IDOR, permission bypass, CORS, **SSRF** |
+ | A02 | Misconfiguration | Debug mode, default passwords |
+ | A03 | Supply Chain Failures | Vulnerable deps, unverified build sources |
+ | A04 | Crypto Failures | Sensitive data encryption, weak crypto |
+ | A05 | Injection | SQL/NoSQL/Cmd Injection, XSS |
+ | A06 | Insecure Design | Rate Limiting, business logic |
+ | A07 | Auth Failures | Brute force, session, weak passwords |
+ | A08 | Integrity Failures | Deserialization, CI/CD |
+ | A09 | Logging & Alerting | Sensitive data in logs, auditing, alerts |
+ | A10 | Exceptional Conditions | Error paths that fail open or leak |
## Review Loop
**⚠️ @CLAUDE.md auto-loop: fix → re-review → ... → ✅ PASS ⚠️**
⛔ Must fix → fix P0 issues → `/codex-security --continue <threadId>` → repeat until ✅ Mergeable.
Max 3 rounds. Still failing → report blocker.
## Verification
- [ ] Each issue tagged with severity (P0/P1/P2)
- [ ] Gate is explicit (✅ Mergeable / ⛔ Must fix)
- [ ] Fix recommendations are specific and actionable
- [ ] Includes verification test method
- [ ] Codex independently researched auth/input/sensitive code
## References
- OWASP prompt: `references/codex-prompt-security.md`
- Examples: `references/examples.md`
- Standards: @rules/security.md
## Examples
```
Input: /codex-security --scope src/controller/
Action: OWASP Top 10 check → output issues + Gate
Input: /dep-audit --level high
Action: npm audit → filter high/critical → output report
```