SkillVerdict
All verdicts

security-review (Sentry)

Install getsentry/skills

Confidence-based reporting, data-flow research before flagging, 17+ reference guides. The strong security skill in this batch.

Verified · Repo on GitHub

What it does

Security code review that reports only HIGH-CONFIDENCE findings: a clear vulnerable pattern plus attacker-controlled input. Before flagging, it must research the whole codebase — trace data flow, check for validation elsewhere, check framework protections — and it separates 'report on the diff you gave me' from 'research the whole repo'. Ships language guides (Python, JavaScript) , infrastructure (Docker) and ~17 vulnerability reference files (injection, XSS, SSRF, CSRF, auth, crypto, deserialization and more).

Who made it / license / last checked

getsentry (Sentry) · License: Apache-2.0 at repo root; skill folder also carries its own LICENSE noting OWASP Cheat Sheet material (CC BY-SA 4.0) · Repo last commit checked: 2026-10-23

Install

npx skills add getsentry/skills --skill security-review

Repo README verifies npx skills add getsentry/skills; add --skill security-review to take just this one, following the Skills CLI pattern used in that README ecosystem. allowed-tools in SKILL.md: Read, Grep, Glob, Bash, Task — it can run commands and spawn tasks during a review.

What files / scripts it runs

SKILL.md (11,808 bytes on 30 Oct; we recorded 11,769 on 19 Oct) + references/, languages/, infrastructure/ markdown. No executable scripts in the skill folder in our clone — the execution risk is the agent's own Bash/Task tools acting on its instructions.

Pros

  • Confidence gating is the whole game in security review — it suppresses the false-positive flood
  • Explicit false-positive awareness (framework auto-escaping, server-controlled config) verified in SKILL.md
  • A methodology plus a knowledge base, not a single checklist file

Cons

  • HIGH-only reporting means best-practice nits are intentionally not reported — pair with a linter/SAST
  • Still an LLM review: it can miss things. It is a first pass, not an audit guarantee

Alternatives

The affaan-m original checklist (below) if you want broad pattern coverage and accept noise; a real SAST tool for production gating.

Notes

We read the skill ourselves; the TimOnWeb teardown (Feb 2026) reached the same conclusion independently. Where we differ from install-count leaderboards: we rank by method, not installs.

Sources

Checked 19 Oct 2026 (Europe/Madrid) from local clones of the repos above. Repo last-commit is a repo date, not a per-skill release date. Install counts, where quoted, are skills.sh leaderboard figures fetched that day and are distribution, not quality.

Verified on 2026-11-04 through the GitHub API: it has had no commit since the 30 Oct check, so the files, sizes and verdict above still hold. Previous check on 2026-10-30, against a fresh clone (repo commit d12f250, 2026-10-23). Since 19 Oct: Sentry edited SKILL.md on the evening of 19 Oct (UTC) to route frontend and Django access-control reviews to the right references; it is now 11,808 bytes, 39 more than we recorded, and the folder gained a SPEC.md on 23 Oct; allowed-tools unchanged (Read Grep Glob Bash Task); 17 reference files in the folder; still no executable scripts. Apache-2.0 unchanged. Verdict unchanged.