Skip to content

Skill

Security Review

waybarrios/opencode-power-pack

Inspects the unmerged commits on a branch and calls out concrete security problems that show realistic exploitation paths, so reviewers can decide whether changes are safe to merge. Unlike broader security-audit or SAST-style tools, it intentionally skips stylistic, architecture, dependency-wide, or general code-review concerns and concentrates only on high-confidence, actionable vulnerabilities in the pending diff.

2 other skills are also called Security Review

Same name, different author, different job. If more than one is installed, the one that runs is whichever the agent matches first.

Situations it fits

There is a pull request waiting and the release is in an hour. I do not want a report about the whole repo - just tell me whether anything in THESE changes is actually exploitable.
Security Review. All four are security reviewers, so the question is scope. waybarrios reads only the unmerged commits on the branch and reports concrete exploitation paths, which is precisely a pre-merge decision. Sentry's scans project source and jeffallan produces a prioritised whole-system audit - both answer a bigger question than the one asked, and both cost more than an hour. affaan-m is design-time guidance for code you have not written yet, which is the wrong direction entirely once the PR exists.
Before merging a feature branch, run a targeted inspection of those unmerged commits for issues an attacker could exploit, then follow with a comprehensive review covering correctness, architecture and tests.
Security Review. Start with the focused branch security check to catch high-confidence exploitable mistakes early; those findings may require code changes that affect design and tests. Doing the broad review first can surface many items, but if a security fix changes interfaces or architecture you'll end up redoing parts of the wide review - the focused pass narrows the highest-risk edits before the full sweep.

3 scenarios in the bank answer to Security Review. The rest are in the game.

Skills it gets confused with

These share a family with Security Review, which is another way of saying they are the ones you might reach for by mistake.

Every comparison with Security Review

Knowing what Security Review does is the easy half. Telling it apart from the others under time pressure is the game.

Today's session

Security Review is part of waybarrios/opencode-power-pack. Licence: MIT. The description above was written for this game, not taken from the skill.