security-review

Security Review Skill

Trigger

• Keywords: security review, OWASP, vulnerability, dep-audit, npm audit, dependency security

When NOT to Use

• General code review (use codex-code-review)
• Functional testing (use test-review)
• Performance issues (not security-related)

Commands

Command	Purpose	When
/codex-security	OWASP Top 10 audit	Security-sensitive code
/dep-audit	Dependency security audit	Periodic / PR

Workflow: /codex-security

Determine scope → Collect changes → Codex OWASP review → Findings + Gate → Loop if Must fix

Step 1: Determine Scope

Parse --scope from arguments, default to src/.

Step 2: Collect Code Changes

Priority order:

1. Uncommitted changes: git diff HEAD -- <scope> | head -1500
2. Recent commits: git diff HEAD~5..HEAD -- <scope> | head -1500
3. Key security files: Glob("**/*{auth,login,password,token,secret,key,credential}*")

Step 3: Codex Security Review

First review: mcp__codex__codex with OWASP prompt. See references/codex-prompt-security.md.

Config: sandbox: 'read-only', approval-policy: 'never'

Save the returned threadId.

Loop review: mcp__codex__codex-reply with re-review template. See references/codex-prompt-security.md.

Step 4: Consolidate Output

Organize results into findings summary table + detailed findings + gate.

OWASP Top 10

Code	Category	Check Focus
A01	Broken Access Ctrl	IDOR, permission bypass, CORS
A02	Crypto Failures	Sensitive data encryption, weak crypto
A03	Injection	SQL/NoSQL/Cmd Injection
A04	Insecure Design	Rate Limiting, business logic
A05	Misconfiguration	Debug mode, default passwords
A06	Vulnerable Comp	Known vulnerable dependencies
A07	Auth Failures	Brute force, session, weak passwords
A08	Integrity Failures	Deserialization, CI/CD
A09	Logging Failures	Sensitive data in logs, auditing
A10	SSRF	URL validation, internal network access

Review Loop

⚠️ @CLAUDE.md auto-loop: fix → re-review → ... → ✅ PASS ⚠️

⛔ Must fix → fix P0 issues → /codex-security --continue <threadId> → repeat until ✅ Mergeable.

Max 3 rounds. Still failing → report blocker.

Verification

• Each issue tagged with severity (P0/P1/P2)
• Gate is explicit (✅ Mergeable / ⛔ Must fix)
• Fix recommendations are specific and actionable
• Includes verification test method
• Codex independently researched auth/input/sensitive code

References

• OWASP prompt: references/codex-prompt-security.md
• Examples: references/examples.md
• Standards: @rules/security.md

Examples

Input: /codex-security --scope src/controller/
Action: OWASP Top 10 check → output issues + Gate

Input: /dep-audit --level high
Action: npm audit → filter high/critical → output report