security-review SKILL.md skillA

security-review from henrigrimm/minnow is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.

mdr add henrigrimm/minnow/security-review@git:20261007.306e7f0

Pins git:20261007.306e7f0 in mdr.lock. Pin the fingerprint instead.

Audit grade

A, 17 of 17 checks passed

Kind

SKILL.md skill

Repository

henrigrimm/minnow

Path

src/skills/security-review/SKILL.md

Versions recorded

3

Latest version

git:20261007.306e7f0, committed Oct 7, 2026

First version recorded

May 19, 2026

Size

1,360 bytes

Repository stars

25

License

AGPL-3.0

OWASP-style security pass on changes or files. Use before merge or for audit requests.

Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.

What the file says

# Security review

## When to use

- Auth, API, file upload, or user-input paths changed
- User asks for security review or `/security-review`

## Steps

1. Identify **trust boundaries**: HTTP APIs, tools, file paths, subprocess, clipboard.
2. Review changed files via `git_diff` or `read_file`.
3. Checklist:

### Injection & execution

- Shell commands: no unsanitized user input in `execute_command`
- File paths: stay under project root unless explicitly allowed
- HTML/JS: no unsanitized user content in DOM (`DOMPurify` where applicable)

### Secrets & data

- No API keys, tokens, or passwords in code or logs
- `.env` and `secrets.json` not committed
- Tool results do not echo env vars

### Access control

- Server routes validate ids (`^[a-z0-9-]+$`) and reject `..`
- User data under `~/.minnow` read only via whitelisted APIs

### Dependencies

- Note risky patterns; do not run `npm audit` unless user asks

4. Report: **Critical** / **High** / **Medium** / **Low** with file references and remediation.

## Do not

- Exfiltrate secrets "to verify"
- Disable security checks without explicit user request

## Tools

`git_diff`, `read_file`, `search_in_file`, `list_directory`

Read the whole file at its exact version.

How to install

mdr add henrigrimm/minnow/security-review@sha256:4e7016b0a4277144

[![mdr](https://markdownregistry.com/badge/art_vwx5b5kihutried7.svg)](https://markdownregistry.com/a/art_vwx5b5kihutried7)

Versions

The registry has recorded 3 versions of this file, between May 19, 2026 and Oct 7, 2026, about one every 70 days.

Audit of the latest version

Source

API

GET https://markdownregistry.com/api/v1/artifacts/art_vwx5b5kihutried7
GET https://markdownregistry.com/api/v1/resolve?ref=henrigrimm/minnow/security-review
GET https://markdownregistry.com/api/v1/blob/4e7016b0a42771446aa92079c7f24525ef81e5f11e83e4a87e5f550ec8dfad64

Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.

Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.

More from henrigrimm/minnow

Every file in henrigrimm/minnow

Other files named security-review

Browse by kind, by grade A, or by owner.