Comparison
Security Review (affaan-m) vs Security Review (waybarrios)
Two different Claude skills are both called Security Review. Security Review (affaan-m) and Security Review (waybarrios) install under the same name and do different jobs, which is exactly how the wrong one ends up running.
Security Review
affaan-m/ecc
Helps developers implement secure features by listing concrete checks and recommended patterns for authentication, input handling, secret management, API endpoints, and payment or sensitive flows. Unlike similarly named tools that scan code or produce vulnerability audits, this one focuses on design-time guidance and implementation checklists - it does not run automated SAST, assign severity scores, or perform penetration-style audits of diffs.
1 scenario in the bank answers to it
Security Review
waybarrios/opencode-power-pack
Inspects the unmerged commits on a branch and calls out concrete security problems that show realistic exploitation paths, so reviewers can decide whether changes are safe to merge. Unlike broader security-audit or SAST-style tools, it intentionally skips stylistic, architecture, dependency-wide, or general code-review concerns and concentrates only on high-confidence, actionable vulnerabilities in the pending diff.
3 scenarios in the bank answer to it
What is the difference between Security Review (affaan-m) and Security Review (waybarrios)?
- Security Review (affaan-m)
- Helps developers implement secure features by listing concrete checks and recommended patterns for authentication, input handling, secret management, API endpoints, and payment or sensitive flows. Unlike similarly named tools that scan code or produce vulnerability audits, this one focuses on design-time guidance and implementation checklists - it does not run automated SAST, assign severity scores, or perform penetration-style audits of diffs.
- Security Review (waybarrios)
- Inspects the unmerged commits on a branch and calls out concrete security problems that show realistic exploitation paths, so reviewers can decide whether changes are safe to merge. Unlike broader security-audit or SAST-style tools, it intentionally skips stylistic, architecture, dependency-wide, or general code-review concerns and concentrates only on high-confidence, actionable vulnerabilities in the pending diff.
Should I use Security Review (affaan-m) or Security Review (waybarrios)?
The clearest answer is a situation each one is unambiguously right for. Both of these are drawn from the game's question bank.
Reach for Security Review (affaan-m) when
I'm about to design a new login + payment flow and want a clear, practical list of secure patterns, do/avoid rules, and concrete checks I should follow as I build the feature so we don't bake in mistakes. I don't want someone to comb the whole repo for every weakness, produce a full cross-system compliance report, or only review a single outstanding change.Winner: security-review-affaan-m gives the practical, design-time guidance this person needs - concrete patterns and checks for authentication, input handling, secret management, endpoints and sensitive flows to follow while writing the feature. What it does that the others do not is focus on implementation guidance up front rather than producing vulnerability scan results, a prioritized compliance audit, or a narrow review of a pending change. Most tempting wrong answer: security-review-getsentry - it finds and labels code-level problems, so it looks useful, but its output is about surfacing and scoring findings from existing source code rather than giving the developer a checklist of patterns and design-time rules to follow. (Other traps: security-reviewer-jeffallan would overdeliver a prioritized, compliance-style audit across code, infra and deps - useful but the wrong scope and heavier than needed; security-review-waybarrios only examines the specific unmerged change and focuses on high-confidence exploit paths, so it won't provide the broad, feature-level implementation guidance the author wants.)
Reach for Security Review (waybarrios) when
Inspect a branch's unmerged commits and call out concrete security problems that show realistic exploitation paths so reviewers can decide whether to block the merge.security-review (waybarrios/opencode-power-pack) is tailored to inspect the unmerged commits on a branch and identify concrete security problems with realistic exploitation paths - exactly what this scenario asks for. security-review-owasp (Sentry) is tempting because it hunts for exploitable issues, but its remit is broader vulnerability discovery and it doesn't emphasize the precise, commit-level branch-diff focus that waybarrios provides. jeffallan produces a wide prioritized audit across code and infra (a heavier, broader audit), and semgrep-rule-creator authors detection rules rather than auditing a branch's pending commits.
What they have in common
Both are filed under Security, the axis along which they collide. That shared ground is what makes an agent pick between them on description alone - and what makes it pick wrong.
Nearby comparisons
- Security Review (affaan-m) vs Security Review (Sentry)
- Dependency Updater vs Security Review (affaan-m)
- Secure Error Handling vs Security Review (affaan-m)
- Security Review (affaan-m) vs Security Reviewer
- Security Review (affaan-m) vs Semgrep Rule Creator
- Security Review (Sentry) vs Security Review (waybarrios)
Reading the difference is not the same as spotting it at speed. That is the game.
Today's session