Review a change for issues that can be abused in this system.
Security is a plugin for Cursor, Codex, and OpenCode 2.1.2. It gives your agent a short guard for ordinary work and an explicit review when you ask:
- Quick looks at the current diff and reports the abuse path and whether it can happen here.
- Review follows that diff into the affected modules and reads scanner output when a scanner is already available.
- Audit runs a six-phase pass and keeps a finding confirmed only after a separate pass fails to disprove it.
The audit method is the Cloudflare security-audit skill at commit c1c8a8c, vendored under skills/security/references with its MIT license.
Use the installation request below or follow the manual installation steps. Complete your app's activation steps: reload Cursor or, after installation is complete in Codex or OpenCode, start a new task or session.
- Cursor: the short rule applies automatically. It stays silent unless the change touches a security-sensitive surface.
- Codex and OpenCode: the same guard across projects is optional. Plugin installation does not edit global instructions. You can use the skills without this setup.
To preview the Codex setup without changing configuration:
$geldmacher-security:security-guard-setup Show the current status and preview setup of the persistent security guard. Do not change configuration.
OpenCode:
@security-guard-setup Show the current status and preview setup of the persistent security guard. Do not change configuration.
The preview shows the proposed change. To configure it, approve the displayed patch and request that it be applied, then start a new task or session. See setup and removal.
Open a project with code changes and ask:
Cursor:
/security Review my current changes for issues that can be abused in this system.
Codex:
$geldmacher-security:security Review my current changes for issues that can be abused in this system.
OpenCode:
@security Review my current changes for issues that can be abused in this system.
/security sends the same request. You get findings tied to this codebase. Files stay unchanged. A finding that still depends on a missing fact is needs_validation, not confirmed. See review examples.
Give your agent the task you want completed. In Cursor, or once the optional guard is configured, the short rule accompanies ordinary work and stays quiet when the change is not security-sensitive. Call a skill when you want a review.
| Situation | Recommended use |
|---|---|
| An ordinary development task | Describe the change as usual. |
| The current diff may be abusable | Ask security for a quick review. |
| The change crosses a trust boundary and you want the surrounding flow | Ask security for a review. |
| You want the repository, or a named scope, audited | Ask security-audit for an audit. |
The usage guide has copyable requests for Cursor, Codex, and OpenCode.
You need Cursor, Codex, or OpenCode 2.1.2 with plugin support, Node.js 22 or newer, and access to GitHub. You do not need to clone this repository. OpenCode support is @opencode/cli 2.1.2, not the opencode-ai 1.x package.
Copy this request into Cursor, Codex, or OpenCode:
Install the latest stable Security release from
https://github.com/geldmacher/security for my current app.
Follow https://github.com/geldmacher/security/blob/main/docs/installation.md,
section "First installation without the skill".
Verify the release before installing and tell me whether a reload or new task is needed.
Your agent downloads and verifies the release, installs it for your app, and reports any remaining activation step. For a manual installation, use the latest stable GitHub Release and follow the verification and installation procedure.
Use the installed update skill:
Cursor:
/install-new-release-from-repo Update Security to the latest stable GitHub Release for Cursor.
Codex:
$geldmacher-security:install-new-release-from-repo Update Security to the latest stable GitHub Release for Codex.
OpenCode:
@install-new-release-from-repo Update Security to the latest stable GitHub Release for OpenCode.
If the skill is missing, use the installation request above. For manual updates, follow the replacement and activation steps. The installation guide also covers previews and recovery.
Security does not ship a sandbox. It does not probe production systems. Scanner commands run only when they are already available or can be started without a global install and without changing the target project. A missing scanner is reported as not checked.
- Usage and examples
- Installation, updates, and recovery
- Contributing and development
- Changelog · Report an issue
MIT · Built by Dennis Geldmacher