Agent skill · Sentry

Security Review (Sentry) skill for Claude Code, Codex and Cursor

Checks code for injection, XSS, auth and authorization flaws and other OWASP issues.

Officialname: security-review★ 1.1k (repo)pushed 2026-10-23LICENSESKILL.md on GitHubchecked 2026-11-07

What it does, in the publisher's words

Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting.

The description field of the SKILL.md. The agent reads only this at startup and decides from it when to load the full skill.

Install Security Review (Sentry)

The skills CLI copies the skill into the folder of each agent you pick (Claude Code, Codex, Cursor, Copilot, Gemini CLI, OpenCode, Windsurf...). Add -g for all projects. Needs Node.js 22.20+. docs

npx skills add getsentry/skills --skill security-review

This repo is a plugin marketplace. Inside Claude Code, add it and install the plugin that holds the skill (sentry-skills), or copy only this skill into ~/.claude/skills. docs

/plugin marketplace add getsentry/skills
/plugin install <plugin>@sentry-skills

# or only this skill:
npx skills add getsentry/skills --skill security-review -a claude-code

Download the skill folder, zip it, then Customize > Skills > + > Create skill > Upload a skill. Code execution must be on (Settings > Capabilities). docs

git clone --depth 1 https://github.com/getsentry/skills.git /tmp/security-review-src
cp -r /tmp/security-review-src/skills/security-review ./security-review
zip -r security-review.zip security-review

Codex reads skills from .agents/skills in the repo or ~/.agents/skills. Type $ in Codex to use one. docs

npx skills add getsentry/skills --skill security-review -a codex

gh skill (GitHub CLI 2.90+, preview) installs it for Copilot in VS Code, the CLI and the cloud agent. Copilot also reads .github/skills and ~/.copilot/skills. docs

gh skill install getsentry/skills security-review

Cursor reads .cursor/skills, .agents/skills and ~/.cursor/skills (and .claude/skills). It does not install loose skills from a GitHub URL, so copy it in. docs

npx skills add getsentry/skills --skill security-review -a cursor

Installs from the GitHub repo; --path picks this skill out of the repo. Default scope is user (all projects). docs

gemini skills install https://github.com/getsentry/skills.git --path skills/security-review

OpenCode reads .opencode/skills, ~/.config/opencode/skills and the Claude and .agents folders. docs

npx skills add getsentry/skills --skill security-review -a opencode

Windsurf (now Devin Desktop) reads .devin/skills, .windsurf/skills and ~/.codeium/windsurf/skills. docs

npx skills add getsentry/skills --skill security-review -a windsurf

Works with

Claude Code, Claude.ai and Claude Desktop, Codex, GitHub Copilot, Cursor, Gemini CLI, OpenCode, Windsurf and other agents that read the open Agent Skills format.

Pre-approves these tools (allowed-tools, experimental in the spec): Read Grep Glob Bash Task.

What's in the SKILL.md

24 sections

Scope: Research vs. Reporting
Confidence Levels
Do Not Flag
General Rules
Server-Controlled Values (NOT Attacker-Controlled)
Framework-Mitigated Patterns
Review Process
1. Detect Context
2. Load Language Guide
3. Load Infrastructure Guide (if applicable)
4. Research Before Flagging
5. Verify Exploitability
6. Report HIGH Confidence Only
Severity Classification
Quick Patterns Reference
Always Flag (Critical)
Always Flag (High)
Always Flag (Secrets)
Check Context First (MUST Investigate Before Flagging)
Output Format
Reference Files
Core Vulnerabilities (references/)
Language Guides (languages/)
Infrastructure (infrastructure/)

Bundled files

LICENSE
SPEC.md
infrastructure/docker.md
languages/javascript.md
languages/python.md
references/api-security.md
references/authentication.md
references/authorization.md
references/business-logic.md
references/cryptography.md
references/csrf.md
references/data-protection.md
references/deserialization.md
references/error-handling.md
references/file-security.md
references/injection.md
references/logging.md
references/misconfiguration.md
references/modern-threats.md
references/ssrf.md
+ 2 more

Loaded only when the instructions point to them.

Facts

Skill name: security-review
Publisher: Sentry (official)
Repo: getsentry/skills
License: LICENSE
SKILL.md size: 1,173 words, 298 lines
Bundled files: 22, 21 docs
Repo stars: 1.1k (as of 2026-10-24)
SKILL.md checked: 2026-11-07

More skills from getsentry/skills

Commit (Sentry style): Writes conventional commit messages with issue references, the way Sentry engineers do.
Find Bugs: Reviews the current branch's changes for bugs, security holes and quality problems.
PR Writer: Drafts or refreshes pull request titles and descriptions written for reviewers.

Related security & auth skills

Security Best Practices Review · OpenAI
Security Threat Model · OpenAI
Sign In With Google (Web) · Google
Agentic Actions Auditor · Trail of Bits
CodeQL Scan · Trail of Bits
Constant-Time Analysis · Trail of Bits
Differential Security Review · Trail of Bits
Semgrep Rule Creator · Trail of Bits

FAQ

What does the security-review skill do?+

Checks code for injection, XSS, auth and authorization flaws and other OWASP issues. In its own SKILL.md, Sentry describes it as: "Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues."

How do I install the security-review skill?+

Run npx skills add getsentry/skills --skill security-review and pick your agents, or use the tab for your agent above. In Claude Code the skill ends up in ~/.claude/skills/security-review/SKILL.md; in Codex and Cursor in .agents/skills/security-review/.

Does Security Review (Sentry) work in Codex, Cursor and Copilot, or only Claude?+

It's a standard SKILL.md, so any agent that reads the Agent Skills format can use it: Claude Code, the Claude apps, Codex, GitHub Copilot, Cursor, Gemini CLI, OpenCode, Windsurf and more.

Who maintains Security Review (Sentry)?+

Sentry, the company or project behind it, in the getsentry/skills repo on GitHub, last pushed 2026-10-23. License: LICENSE.

Read a skill's SKILL.md and scripts before you install it: skills aren't verified by any agent vendor. Claude skills marketplace · How to install skills · MCP servers