Mmcp.market

security-review skill

by a5c-ai·a5c-ai/babysitter·1.8k stars·MIT

Security vulnerability assessment identifying OWASP risks, injection vectors, authentication issues, and data exposure with severity classification.

A100/100content scan

Is the security-review skill safe?

Clean: nothing in its files matched our rules. We read 2 files in the folder on 2026-09-28.

No findings.

Install the security-review skill

A skill is a folder. Copy it into your agent's skills folder and the agent loads it when the task matches its description. 

git clone --depth 1 https://github.com/a5c-ai/babysitter.git /tmp/babysitter
mkdir -p ~/.claude/skills
cp -r /tmp/babysitter/library/methodologies/rpikit/skills/security-review ~/.claude/skills/security-review
available in every project

In the Claude apps, zip the folder and upload it from the Skills settings. The folder on GitHub

The instructions your agent would load

SKILL.md as published, without the frontmatter. Read it on GitHub

  • Before any code merge involving user-facing changes
  • As part of the /review-security command
  • Mandatory for high-stakes implementations

Process

  1. Identify modified files with security relevance
  2. Scan for common vulnerability patterns
  3. Assess authentication and authorization changes
  4. Check for data exposure risks
  5. Evaluate dependency security
  6. Classify severity and provide recommendations

Severity Levels

  • Critical: Immediate exploitation risk
  • High: Significant vulnerability requiring fix before merge
  • Medium: Vulnerability that should be addressed soon
  • Low: Minor security improvement opportunity

Key Rules

  • Security review failure halts implementation
  • All findings must include file paths and line numbers
  • Provide actionable remediation steps
  • Reference OWASP categories where applicable

Tool Use

Invoke via babysitter process: methodologies/rpikit/rpikit-review

More skills from a5c-ai/babysitter

  • Aadversarial-reviewFresh adversarial code review with binary PASS/FAIL verdicts, evidence citations, and anchoring bias prevention via fresh reviewer spawning.
  • Aagent-boosterWASM-based instant code transforms for simple tasks, achieving 352x speedup over LLM inference with zero cost.
  • Aagent-coordinationCoordinate Crew (persistent) and Polecat (transient) agents using Gas Town's hook-based work distribution and GUPP principle.
  • Aagent-dispatch
  • Aanti-driftHierarchical coordination and drift detection with frequent checkpoints, shared memory coherence validation, role specialization enforcement, and short task cycles.
  • Aarchitecture-design
  • Aarchitecture-patternsSystem and API design guidance covering component boundaries, data flow, integration patterns, and scalability considerations.
  • Aassimilate-popular-workflowsThis skill should be used when the user asks to "find skills in the wild", "assimilate popular workflows", "discover SKILL.md files in repos", "research external skills", "find workflow patterns", "survey the skill landscape", "what skills exist out there", or wants to investigate public repositories for extractable processes, babysitter plugins, and reusable procedural insights. Searches GitHub for SKILL.md files, classifies repos by archetype, and maintains structured research under docs/reference-repos/.
  • Aaudit-trail
  • AbabysitOrchestrate via @babysitter. Use this skill when asked to babysit a run, orchestrate a process or whenever it is called explicitly. (babysit, babysitter, orchestrate, orchestrate a run, workflow, etc.)
  • Ababysit-babysitter-issuesThis skill should be used when the user asks to "babysit issues", "work on assigned issues", "check a5c-agent issues", "process babysitter issues", or wants to find and work on open GitHub issues assigned to a5c-agent in the babysitter repo.
  • Abehavior-contractBug condition/postcondition formalization as testable Behavior Contracts. Defines invariants that must be preserved across fixes.

All agent skills → · MCP servers