SkillVerdict
All verdicts

security-review (davila7 templates)

Redistributed copy — install the original davila7/claude-code-templates

davila7's cc-skill-security-review is 96% identical to affaan-m's original security-review (author field still affaan-m). Install the original instead.

Verified · Repo on GitHub

What it does

A security checklist skill for auth, user input, secrets, API endpoints and payments — or rather, affaan-m's security checklist skill, redistributed. In the current repo it lives at cli-tool/components/skills/development/cc-skill-security-review/SKILL.md with frontmatter name: cc-skill-security-review (it said name: security-review on 19 Oct).

Who made it / license / last checked

Listed author in its own frontmatter: author: affaan-m — in the davila7 repo. Repo license: MIT (davila7) · Original: affaan-m/everything-claude-code · Repo last commit checked: 2026-10-29 (a «components and trending data» chore commit)

Install

# Do not install this copy. Install Sentry's instead:
npx skills add getsentry/skills --skill security-review

We deliberately do not give this copy a clean install pitch. If you specifically want the affaan-m checklist, go to affaan-m/everything-claude-code and judge it there, with attribution intact.

What files / scripts it runs

Single SKILL.md (12,256 bytes on 30 Oct; 12,233 for the version we read on 19 Oct, which we misprinted as 12,213). Our own diff: 96.1% text similarity (Python difflib SequenceMatcher, default settings), re-measured on 30 Oct: still 96.1% (96.4% without autojunk, 95.0% line by line) to affaan-m/everything-claude-code skills/security-review/SKILL.md (12,955 bytes), differing mainly in frontmatter (metadata: origin: ECC on the original vs author/version under metadata on the copy). No added scripts, references or methodology that we could find.

Pros

  • Attribution is at least visible in the author field
  • The underlying checklist is not worthless — it is just not this repo's work, and it is the noisier checklist style

Cons

  • Copy with no meaningful addition we could detect
  • Checklist-style review flags patterns without tracing whether input is actually attacker-controlled — expect false positives (e.g. server config flagged as SSRF), per the original's design
  • Installing copies rewards duplication and strands you from upstream fixes

Alternatives

getsentry/skills security-review (reviewed here, our pick); affaan-m/everything-claude-code security-review at the source if you want this exact checklist.

Notes

This is the one place we use our 'Copy' verdict, and only because we measured it ourselves. Similarity of other same-named skills we spot-checked (e.g. andginja vs Corey Haines copywriting, ~5%) did not meet that bar.

Sources

Checked 19 Oct 2026 (Europe/Madrid) from local clones of the repos above. Repo last-commit is a repo date, not a per-skill release date. Install counts, where quoted, are skills.sh leaderboard figures fetched that day and are distribution, not quality.

Verified on 2026-11-04 through the GitHub API: neither it nor the original it is compared with has had a commit since the 30 Oct check, so the files, sizes and verdict above still hold. Previous check on 2026-10-30, against a fresh clone (repo commit 52701d8, 2026-10-29). Since 19 Oct: Re-measured against affaan-m/everything-claude-code skills/security-review/SKILL.md (12,955 bytes, commit 91b5f6a of 2026-10-29): 96.1%. Only the copy's frontmatter changed: name became cc-skill-security-review and author/version moved under metadata (commits 13da94c of 24 Oct and 542e625 of 26 Oct, +23 bytes). It still says author: affaan-m and, as on 19 Oct, uses ✅/❌ where the original says PASS/FAIL. Verdict unchanged.