Review Security launches one security-review subagent to analyze repository changes and return prioritized, actionable security findings.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install review-security
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install review-security using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Review Security?
Review Security is an Openclaw Skills workflow for running a focused security assessment against Git repository changes. It delegates analysis to exactly one security-review subagent, which computes the local diff from the active repository rather than requiring the calling agent to calculate it.
The skill supports branch-based reviews and uncommitted-change reviews, handles explicit pull request or branch targets, validates checkout state, retries recoverable subagent failures once, and presents findings in a compact severity-sorted format. It is designed for developers and AI coding agents that need a consistent security review process without automatically modifying code.
Review Security Use Cases
- Run
/review-securitybefore opening or merging a pull request. - Review committed, staged, and unstaged changes against the repository's default base branch.
- Inspect only dirty or not-yet-committed working-tree changes.
- Review a specific GitHub pull request, PR number, or branch after checking out the requested target.
- Apply custom security review instructions supplied by the user.
- Obtain a concise list of security findings without allowing the skill to modify code automatically.
- Use Openclaw Skills to standardize security checks across repositories and AI-assisted development workflows.
How Review Security Works
- Detect that the user explicitly requested
/review-securityand identify the active workspace or repository root. - Determine the review mode: use
branch changesby default, oruncommitted changeswhen the user requests local, dirty, or not-yet-committed changes. - If a specific PR or branch was requested, resolve its target branch and check whether it is currently checked out.
- If necessary, attempt to switch to the target branch. If Git blocks the switch because of local changes or conflicts, explain the blocker and ask for confirmation before stashing; never stash without approval.
- Launch exactly one
security-reviewsubagent withrun_in_background: falseunless background execution was explicitly requested. - Send the required prompt fields: absolute repository path, diff mode, and optional base branch or custom instructions only when applicable.
- Allow the subagent to compute the repository diff and perform the security analysis; do not calculate the diff beforehand.
- If invocation parameters are incorrect, fix them and retry once. For other failures, retry once with the same prompt shape, then stop if the error persists.
- Summarize the result: report an empty diff in one sentence, provide a one-line no-issues status, or show findings in a severity-sorted markdown table.
- Do not fix findings or rerun the review unless the user explicitly requests those next steps.
Review Security Setup
Prerequisites
- An Openclaw-compatible agent runtime with the Review Security skill available.
- A Git repository containing the code changes to inspect.
- The repository path must be accessible as the active workspace or repository root.
- Git must be able to inspect branches and, when required, switch to the requested review target.
Invoke the skill
Run the skill from the agent interface with:
/review-security
For a working-tree-only review, explicitly request uncommitted changes. For a pull request or branch review, provide its URL, PR number, or branch name, for example:
/review-security review https://github.com/owner/repository/pull/123
The skill constructs the internal subagent prompt with Full Repository Path, Diff, and optional Base Branch or Custom Instructions fields. Do not manually precompute or supply the diff unless the workflow specifically requires it.
Review Security Data Schema & Taxonomy
Subagent prompt fields
| Field | Required | Format and behavior |
|---|---|---|
Full Repository Path |
Yes | Absolute path to the active repository or workspace root. |
Diff |
Yes | Either branch changes or uncommitted changes. |
Base Branch |
No | Included only when comparing against a known, non-default base branch. |
Custom Instructions |
No | Included only when the user provides specific review guidance. |
Review modes
branch changes: Compares the current branch with the merge-base of the repository's inferred default or base branch, including committed, staged, and unstaged changes.uncommitted changes: Limits analysis to local changes that have not been committed.
Result taxonomy
Findings are summarized using:
| Output element | Description |
|---|---|
Severity |
Finding priority, used to sort results from highest to lowest. |
Location (file:line) |
Source file and exact line associated with the finding. |
Finding |
Compact description of the security issue. |
An empty diff produces a no-diff message. A clean review produces a one-line no-issues status. Failed reviews return a short error or blocker after the permitted retry behavior.
Review Security Advanced Features
- Exactly-one-subagent orchestration prevents duplicate security reviews and keeps execution predictable.
- Foreground execution is the default, with background execution available only when explicitly requested.
- Automatic base-branch inference supports repository-specific merge-base comparisons without unnecessary configuration.
- Explicit PR and branch targeting includes checkout validation before analysis begins.
- Safe Git workflow handling asks for user approval before stashing changes when checkout is blocked.
- Prompt-shape validation detects missing paths, missing diff modes, incorrect subagent types, and malformed invocations.
- Controlled retry logic retries invocation errors immediately and limits all other failures to one additional attempt.
- Custom review instructions can be passed through without changing the required prompt structure.
- Severity-first markdown reporting gives developers a compact, actionable security summary.
- Openclaw Skills integration makes the workflow reusable across repositories and AI coding environments.
SKILL.md
Loading
Related Openclaw Skills
CLI Status Line
Configure a local, dynamic CLI status line that displays live session, model, context-window, workspace, and Git information above the prompt.
Split to PRs
Split mixed Git changes into small, reviewer-aligned pull requests without risking the original work.
Update Codex/VSCode Settings
Safely modify Codex and VSCode user settings.json values while preserving existing configuration and validating the result.
Codex CLI Configuration Manager
Manage Codex CLI settings, permissions, models, sandbox behavior, and user preferences through a structured JSON configuration workflow.
Rename Chat
Rename Chat turns the current conversation focus into a concise, readable title through the /rename-chat command.
Migrate to Codex
Migrate supported Claude Code instructions, skills, agents, hooks, and MCP configuration into validated Codex project or global files.
Featured*
