Review code for security risks like injection, auth flaws, sensitive data leaks, and recommend precise, actionable fixes with risk levels and patches.

This skill appears to do what it says: review the workspace for security issues and suggest fixes. Before running it, consider: (1) the skill will read files in your current workspace — remove or temporarily redact any secrets, credentials, or sensitive files you don't want inspected or leaked in output; (2) scope the review (specific files or directories) rather than scanning an entire repository if it contains private keys or production credentials; (3) run the review on a local copy or sanitized snapshot if you are concerned; (4) the skill's source/homepage is unknown — if provenance matters to you, prefer tools from known authors or with visible source code; (5) if you are uncomfortable with autonomous invocation, you can disable model-invocation for skills or require explicit user invocation. These are operational precautions rather than technical blockers.

Type: OpenClaw Skill Name: code-security Version: 0.1.0 The 'code-security' skill bundle is designed to assist users in performing security audits on application code. The instructions in SKILL.md and the configuration in agents/openai.yaml focus on identifying common vulnerabilities such as SQL injection, XSS, and credential leaks, and providing remediation advice. No malicious intent, data exfiltration, or suspicious execution patterns were identified.