code-security-review
Use when asked to security-review a change, check a diff/PR for vulnerabilities, threat-model a change, or decide if code is safe to deploy — 'security review', 'any vulnerabilities here', 'is this safe to ship', 'appsec sign-off'. Reviews the change like an application-security engineer gating a deploy: maps the attack surface and trust boundaries first, audits the standard vulnerability classes, confirms each finding is actually exploitable, and returns a ship / ship-with-fixes / do-not-ship verdict with risk-ranked, evidence-backed findings. Reports and gates; does not edit code. Not for correctness bugs (use code-review-and-quality), requirements conformance (use requirements-qa), or running the app (use verify).
Works with
This skill's source license couldn't be confirmed as safe to mirror here, so it isn't inlined. View the full skill directly on its source repository.
View on GitHubMore Code Review skills
pr-to-video
heygen-com/hyperframes
Turn a GitHub pull request (a PR URL, owner/repo#N, or 'this PR' in a checked-out repo) into a code-change explainer video — changelog, feature reveal, fix, or refactor walkthrough built from the diff, commits, and files: the input is a code change, not a website. Not a product promo (/product-launch-video) or a no-PR topic explainer (/faceless-explainer). Unclear → /hyperframes.
receiving-code-review
obra/superpowers
Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation
public-relations
coreyhaines31/marketingskills
When the user wants help with public relations, earned media, press coverage, journalist outreach, or media strategy (not pull requests). Also use when the user mentions 'PR,' 'public relations,' 'press,' 'press release,' 'press coverage,' 'media outreach,' 'pitch a journalist,' 'get featured,' 'media list,' 'media kit,' 'press kit,' 'newsjacking,' 'news hijack,' 'HARO,' 'Qwoted,' 'Featured,' 'Help A Reporter,' 'reporter request,' 'tech press,' 'TechCrunch,' 'earned media,' 'thought leadership placement,' 'op-ed,' 'guest article,' 'press contacts,' 'podcast prep,' 'going on a podcast,' 'podcast guest,' 'prep me for this podcast,' or 'how do I get press.' Use this for earned media work — finding journalists, pitching stories, newsjacking, prepping podcast appearances, and responding to press requests. For startup/SaaS/AI directory submissions, see directory-submissions. For product launches, see launch. For social-media engagement, see social. For cold-email outreach to prospects, see cold-email.
