Security Review (waybarrios) vs What Leaked About You (useosint)
Security Review (waybarrios) and What Leaked About You (useosint) are both Security skills, so an agent choosing between them is matching on descriptions that overlap. Here is where they actually diverge.
Security Review
waybarrios/opencode-power-pack
Inspects the unmerged commits on a branch and calls out concrete security problems that show realistic exploitation paths, so reviewers can decide whether changes are safe to merge. Unlike broader security-audit or SAST-style tools, it intentionally skips stylistic, architecture, dependency-wide, or general code-review concerns and concentrates only on high-confidence, actionable vulnerabilities in the pending diff.
2 scenarios in the bank answer to it
What Leaked About You
useosint
Checks an email, username, phone, or name against curated data-breach services — Have I Been Pwned, DeHashed, IntelX and the like — to enumerate which breaches an identity appears in and read what those records reveal, chiefly the list of services the person actually used. It is breach-exposure reconnaissance about a person, not a codebase tool: it does not scan your repository for hardcoded secrets, and it never uses a leaked password to access anything — reading the exposure is the whole job.
2 scenarios in the bank answer to it
What is the difference between Security Review (waybarrios) and What Leaked About You (useosint)?
- Security Review (waybarrios)
- Inspects the unmerged commits on a branch and calls out concrete security problems that show realistic exploitation paths, so reviewers can decide whether changes are safe to merge. Unlike broader security-audit or SAST-style tools, it intentionally skips stylistic, architecture, dependency-wide, or general code-review concerns and concentrates only on high-confidence, actionable vulnerabilities in the pending diff.
- What Leaked About You (useosint)
- Checks an email, username, phone, or name against curated data-breach services — Have I Been Pwned, DeHashed, IntelX and the like — to enumerate which breaches an identity appears in and read what those records reveal, chiefly the list of services the person actually used. It is breach-exposure reconnaissance about a person, not a codebase tool: it does not scan your repository for hardcoded secrets, and it never uses a leaked password to access anything — reading the exposure is the whole job.
Should I use Security Review (waybarrios) or What Leaked About You?
The clearest answer is a situation each one is unambiguously right for. Both of these are drawn from the game's question bank.
Reach for Security Review (waybarrios) when
There is a pull request waiting and the release is in an hour. I do not want a report about the whole repo — just tell me whether anything in THESE changes is actually exploitable.
All four are security reviewers, so the question is scope. waybarrios reads only the unmerged commits on the branch and reports concrete exploitation paths, which is precisely a pre-merge decision. Sentry's scans project source and jeffallan produces a prioritised whole-system audit — both answer a bigger question than the one asked, and both cost more than an hour. affaan-m is design-time guidance for code you have not written yet, which is the wrong direction entirely once the PR exists.
Reach for What Leaked About You when
While cleaning out a dusty server closet, you spot a sticky note with your 2014 gaming alias. You dive into dump trawlers to see which tiny subscription box sites and forgotten hobby forums once held that string, purely to build a hit list, never to touch a password field.
This skill performs targeted reconnaissance on a single individual’s historical data exposure, querying compiled leak indexes to discover which external services originally stored a given identifier, without attempting to exploit or access anything. It wins here because your scenario explicitly describes trawling dumps to catalogue which small third-party businesses once held your old tag, which maps exactly to that exposure-readout mission, whereas the other options focus on writing code scanners, patching dependencies, or sanitizing server error output.
What they have in common
Both are filed under Security, the axis along which they collide. That shared ground is what makes an agent pick between them on description alone — and what makes it pick wrong.
Nearby comparisons
- Security Review (affaan-m) vs Security Review (waybarrios)
- Security Review (Sentry) vs Security Review (waybarrios)
- Dependency Updater vs Security Review (waybarrios)
- Secure Error Handling vs Security Review (waybarrios)
- Security Review (waybarrios) vs Security Reviewer
- Security Review (waybarrios) vs Semgrep Rule Creator
Reading the difference is not the same as spotting it at speed. That is the game.
Today's session