security-review Skill
Security assessment workflow in two modes: architectural (design) and code (implementation). Use when a security trigger is detected during planning (architectural mode) or implementation/review (code mode). Covers STRIDE, OWASP, dependency scanning, Azure compliance, and GitHub security alerts. Do not use for general Published by microsoft in devsquad-copilot.
What is security-review Skill?
Security assessment workflow in two modes: architectural (design) and code (implementation). Use when a security trigger is detected during planning (architectural mode) or implementation/review (code mode). Covers STRIDE, OWASP, dependency scanning, Azure compliance, and GitHub security alerts. Do not use for general Published by microsoft in devsquad-copilot. This profile combines repository metadata with install, compatibility, and usage signals so developers can quickly decide whether it fits their agent workflow before opening the source repository.
Automated repository signals based on public metadata such as recency, license, installation evidence, and adoption. These are not a security audit or endorsement.
Key capabilities
- Includes SKILL.md support
- Reusable instructions support
- Security review
- Data analysis
- Design and media
- Security review use cases
- Data analysis use cases
Technical details
- Install or run with Copy skill directory
When to use security-review Skill
- Use it for security review.
- Use it for data analysis.
- Use it for design and media.
Built with
Editorial notes
Source
- Creator: microsoft
- Repository: microsoft/devsquad-copilot
- Skill file: .github/plugins/devsquad/skills/security-review/SKILL.md
What it does
Security assessment workflow in two modes: architectural (design) and code (implementation). Use when a security trigger is detected during planning (architectural mode) or implementation/review (code mode). Covers STRIDE, OWASP, dependency scanning, Azure compliance, and GitHub security alerts. Do not use for general
Skill instructions
Security Review Security Principles | Principle | Application | |-----------|-------------| | CIA Triad | Confidentiality, Integrity, Availability in every assessment | | Defense in Depth | Multiple layers; never rely on a single control | | Least Privilege | Minimum permissions for each component | | Secure by Default | Default configurations must be secure | | Zero Trust | Never trust, always verify | | Shift Left | Detect issues early in design, not in production | Mode Detection Determine the operating mode from the calling agent's context: Architectural Mode (called from plan): - Handoff from the plan agent after ADR creation - Feature involves: auth, sensitive data, external APIs, payments Code Mode (called from implement or review): - Handoff from the implement agent after implementation - Reference to specific files or diff --- Architectural Mode (Design Security) When to Execute This mode is mandatory when the feature involves: | Trigger | Description | |---------|------------
Explore related resources
Frequently asked questions
What is security-review?
security-review is a open-source AI agent skill with Copy skill directory. Security assessment workflow in two modes: architectural (design) and code (implementation).
Who is security-review best for?
security-review is best for reusing agent instructions, scripts, and references, security review workflows, data analysis workflows, design and media workflows.
How do I install security-review?
Install or run security-review using Copy skill directory. Check security-review for the latest setup command.
Is security-review actively maintained?
security-review may need a closer maintenance check before production use.
Auto-fetched from GitHub.
