When the user needs a security assessment — threat modeling, vulnerability review, auth flow audit, dependency scanning, or says "is this secure", "review for vulnerabilities", "threat model", "security audit", "pen test prep".
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Security Review
## When to Use
- The user wants a security audit of their application, infrastructure, or specific feature
- They need a threat model before launching or a penetration test preparation review
- They have a dependency vulnerability alert and need remediation guidance
- They are handling sensitive data (PII, payment, health) and need verification
- Code audit, secrets detection, or compliance assessment is requested
## Context Required
From `startup-context`: tech stack, deployment environment, compliance requirements, data types. Also ask:
- **Scope** — Full app, feature, auth system, single PR, infrastructure, or cloud environment
- **Data types** — PII, payment, health, credentials, or other sensitive data handled
- **Compliance requirements** — SOC 2, HIPAA, PCI-DSS, GDPR, ISO 27001
- **Authorization** — Confirm written authorization exists before any active testing
## Workflow
Follow a five-phase methodology. Automated scanning precedes manual review. Authorization verification is mandatory before active testing.
…
The line at the top of this page pins the label git:20260403.b0c6483, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
The registry has recorded 2 versions of this file, between Mar 16, 2026 and Apr 3, 2026, about one every 17 days. Its first recorded version is graded B and its latest A.
GET https://markdownregistry.com/api/v1/artifacts/art_zxokpgzks6zbdgri
GET https://markdownregistry.com/api/v1/resolve?ref=maudeunfledged834/startup-founder-skills/security-review
GET https://markdownregistry.com/api/v1/blob/b6c434d7ae90d59ad521b1bdea27feb21e5e8eba34a5868023f741689f6482ef
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
maudeunfledged834/startup-founder-skills · skills/accelerator-application/SKILL.md · When the user wants to apply to startup accelerators, incubators, or fellowship programs. Also use when the user…
maudeunfledged834/startup-founder-skills · skills/architecture-design/SKILL.md · When the user needs to design or evaluate system architecture — service boundaries, data models, API contracts…
maudeunfledged834/startup-founder-skills · skills/board-update/SKILL.md · When the user needs to write a monthly or quarterly investor update, prepare a board deck, or communicate company…
maudeunfledged834/startup-founder-skills · skills/churn-analysis/SKILL.md · When the user needs to identify at-risk accounts, understand why customers are leaving, reduce churn rate, build health…
maudeunfledged834/startup-founder-skills · skills/cicd-setup/SKILL.md · When the user needs to set up or improve CI/CD pipelines — GitHub Actions, GitLab CI, deployment automation, or says…
maudeunfledged834/startup-founder-skills · skills/code-review/SKILL.md · When the user asks for a code review, shares code for feedback, or says "review this", "check my code", "what's wrong…
maudeunfledged834/startup-founder-skills · skills/cold-outreach/SKILL.md · When a founder needs to write cold emails or LinkedIn messages to prospects, partners, or investors. Activate when the…
maudeunfledged834/startup-founder-skills · skills/community-discovery/SKILL.md · When the user wants to find Slack groups, Discord servers, Reddit communities, forums, or online communities where…
maudeunfledged834/startup-founder-skills · skills/competitive-analysis/SKILL.md · When the user needs to evaluate competitors, understand the competitive landscape, or position their product against…
maudeunfledged834/startup-founder-skills · skills/competitor-monitoring/SKILL.md · When the user wants to set up ongoing tracking of competitor activity — pricing changes, feature launches, hiring…
maudeunfledged834/startup-founder-skills · skills/content-strategy/SKILL.md · When the user needs to plan, prioritize, or structure a content program -- including identifying content pillars…
maudeunfledged834/startup-founder-skills · skills/contract-review/SKILL.md · When the user needs to review an existing contract, assess risk in proposed terms, or evaluate a contract before…
affaan-m/ecc · .agents/skills/security-review/SKILL.md · Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or…
affaan-m/ecc · .kiro/skills/security-review/SKILL.md · Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or…
affaan-m/ecc · docs/es/skills/security-review/SKILL.md · Usar este skill al agregar autenticación, manejar entradas de usuario, trabajar con secretos, crear endpoints de API o…
microsoft/power-platform-skills · plugins/power-pages/skills/security-review/SKILL.md · Runs a guided, end-to-end security review of a Power Pages site and consolidates every finding into one HTML report…
kklimuk/docx-cli · .claude/skills/security-review/SKILL.md · Review code for security vulnerabilities. Use when the user says 'security review', 'security audit', 'check for…
