Tools tagged with "Security Review"

Reference: detailed uninstall, disable, and re-enable workflows for community skills installed via the legal builder hub. Safe by default — refuses to touch fir

Evaluate a local Codex plugin in engineer-friendly language. Use when the user says "evaluate this plugin", "audit this plugin", "why did this score that way",

PAO workflow for scanning, drafting, and presenting community responses with human review gate

Uninstall a community skill that was installed via the hub. Confirms before deleting files, refuses to touch first-party plugin skills, and logs every action. U

Evaluate a local Codex skill in engineer-friendly terms. Use when the user says "evaluate this skill", "give me an analysis of the game dev skill", "audit this

Append screenshot updates from a lab audit run onto an EXISTING open fix-PR branch in the active instance's lab repo (microsoft/mcs-labs by default). Replaces m

Track the IP portfolio — registrations, renewals, maintenance fees, and use declarations. Use when checking what's renewing, adding or updating an asset, record

Use for a standard, single-pass security audit of an entire repository or a scoped path, package folder, or submodule with no diff to review. This is the defaul

Audit RVAS delivery session content (tracks, challenges, docs, starter code) for correctness, hallucinations, outdated information, pacing, broken links, and co

Static source-code vulnerability scan. Reads a target directory (and THREATMODEL.md if present), spawns parallel review subagents per focus area, and writes VUL

Use when Codex is already in the attack-path-analysis phase of a security scan or the user explicitly asks to trace a security finding from source to sink and c

Open a PR on the active instance's lab repo (microsoft/mcs-labs by default) that adds a NEW lab built by mcs-lab-builder. Stages the assembled labs/<slug/README

The front door for this repo. With no argument: a 30-second intro, then an offer to walk you through your first run on the canary target. With a question: answe

Manage Mixpanel Headless authentication: check session state, list/add/use accounts, run OAuth login, switch projects/workspaces, manage targets, and check brid

Team-wide charter and history optimization through skill extraction

Adapt this C/C++ ASAN vulnerability pipeline to a different vulnerability class, target shape, language, or detection mechanism. Use when the user wants to port

Use when using Cobrowse.

After mcs-lab-issue-filer has filed (or commented on) the audit issue for a lab, apply the findings' suggestedcorrection diffs to the lab markdown and copy any

House cold-start for the litigation plugin — branches by role (in-house, firm associate, solo) and side (plaintiff, defense, both), captures risk calibration, l

Twilio Conversation Intelligence development guide. Use when building real-time or post-call conversation analysis, language operator pipelines, sentiment analy

PAO workflow for scanning, drafting, and presenting community responses with human review gate

Entity compliance tracker — initialize, report upcoming deadlines, update status, run health audit, export to CSV. Maintains a compliance-tracker.yaml built fro

Use when summarizing a fund or ETF with Morningstar ratings, returns, risk, holdings, fees, and caveats.

Team-wide charter and history optimization through skill extraction

Generate candidate fixes for verified security findings. Consumes TRIAGE.json (preferred), VULN-FINDINGS.json, or a vuln-pipeline results directory. Pipeline in

Use when the user asks for a security review of a pull request, commit, branch diff, working-tree patch, or other Git-backed change set.

Implement OpenAI Harness Engineering practices in any repository. Use when setting up or refactoring agent-first workflows, writing or upgrading AGENTS.md and P

Identify, categorize, and prioritize technical debt. Trigger with "tech debt", "technical debt audit", "what should we refactor", "code health", or when the use

Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository

Install, authenticate, and verify the Defender CLI (defender) on the local machine. Downloads the standalone binary to ~/.mdc/, verifies the install script's Au

Identify, assess, and mitigate operational risks. Trigger with "what are the risks", "risk assessment", "risk register", "what could go wrong", or when the user

Audit SwiftUI runtime performance from code first. Use when diagnosing slow rendering, janky scrolling, expensive updates, or profiling needs.

Use this skill when the user wants customer-facing release notes generated from merged pull requests or commits.

Evaluate a vendor — cost analysis, risk assessment, and recommendation. Use when reviewing a new vendor proposal, deciding whether to renew or replace a contrac

Zoom Meeting SDK for Electron desktop applications. Use when embedding Zoom meetings in an Electron app with the Node addon wrapper, JWT auth, join/start flows,

Use when you need true understanding of a complex system — not a quick answer. Parallax Discovery is a multi-agent, multi-pass investigation methodology that co