Security Review Pack

Server-side entitlement, secret handling and MCP permission risk review.

Compatibility93

Build Stack With This Pack

Compatible Models

GPT-5.5
Claude Opus
Codex

Inside The Pack

rules
threat model
review checklist

Included Workflows

Entitlement audit
Secrets checklist
MCP risk labels
Path safety review

Install Skill Pack

Download through the server-checked manifest API, run the installer from this project root, then restart Codex.

Download JSON

Install command

node scripts/install-skill-pack.mjs ./security-review.skillpack.json

Codex skills install into $CODEX_HOME/skills. The installer does not overwrite existing skill folders.

{
  "schemaVersion": 1,
  "kind": "artificial-search.skill-pack",
  "id": "security-review",
  "name": "Security Review Pack",
  "summary": "Server-side entitlement, secret handling and MCP permission risk review.",
  "tier": "Pro",
  "compatibilityScore": 93,
  "notice": "This installs Codex skill files from the pack manifest. MCP servers still require a separate verified mcp.json configuration.",
  "install": {
    "target": "$CODEX_HOME/skills",
    "command": "node scripts/install-skill-pack.mjs ./security-review.skillpack.json",
    "steps": [
      "Download this manifest as security-review.skillpack.json.",
      "Run the installer from the Artificial Search project root.",
      "Restart Codex after installation so the new skills are loaded."
    ]
  },
  "skills": [
    {
      "id": "security-review-rules",
      "name": "Security Review Pack Rules",
      "description": "Rules skill for Security Review Pack. Server-side entitlement, secret handling and MCP permission risk review.",
      "files": [
        {
          "path": "SKILL.md",
          "content": "---\nname: security-review-rules\ndescription: \"Rules skill for Security Review Pack. Server-side entitlement, secret handling and MCP permission risk review.\"\n---\n\n# Security Review Pack Rules\n\nUse this skill when a task matches the Security Review Pack pack.\n\n## Pack Summary\n\nServer-side entitlement, secret handling and MCP permission risk review.\n\n## Compatible Models\n\n- GPT-5.5\n- Claude Opus\n- Codex\n\n## Pack Contents\n\n- rules\n- threat model\n- review checklist\n\n## Operating Rules\n\n- Use the pack scope before choosing a model, MCP server or prompt chain.\n- Keep generated outputs tied to explicit user intent and validated project context.\n- Do not expose secrets, private files or credentials through MCP tools.\n"
        }
      ]
    },
    {
      "id": "security-review-workflow",
      "name": "Security Review Pack Workflow",
      "description": "Workflow skill for Security Review Pack. Server-side entitlement, secret handling and MCP permission risk review.",
      "files": [
        {
          "path": "SKILL.md",
          "content": "---\nname: security-review-workflow\ndescription: \"Workflow skill for Security Review Pack. Server-side entitlement, secret handling and MCP permission risk review.\"\n---\n\n# Security Review Pack Workflow\n\nUse this skill when a task matches the Security Review Pack pack.\n\n## Pack Summary\n\nServer-side entitlement, secret handling and MCP permission risk review.\n\n## Compatible Models\n\n- GPT-5.5\n- Claude Opus\n- Codex\n\n## Pack Contents\n\n- rules\n- threat model\n- review checklist\n\n## Operating Rules\n\n- Entitlement audit\n- Secrets checklist\n- MCP risk labels\n- Path safety review\n"
        }
      ]
    },
    {
      "id": "security-review-validation",
      "name": "Security Review Pack Validation",
      "description": "Validation skill for Security Review Pack. Server-side entitlement, secret handling and MCP permission risk review.",
      "files": [
        {
          "path": "SKILL.md",
          "content": "---\nname: security-review-validation\ndescription: \"Validation skill for Security Review Pack. Server-side entitlement, secret handling and MCP permission risk review.\"\n---\n\n# Security Review Pack Validation\n\nUse this skill when a task matches the Security Review Pack pack.\n\n## Pack Summary\n\nServer-side entitlement, secret handling and MCP permission risk review.\n\n## Compatible Models\n\n- GPT-5.5\n- Claude Opus\n- Codex\n\n## Pack Contents\n\n- rules\n- threat model\n- review checklist\n\n## Operating Rules\n\n- Check the recommended model and agent against the task constraints.\n- Verify every MCP server permission before using the generated config.\n- Run the relevant lint, build, smoke or review gate before delivery.\n"
        }
      ]
    }
  ]
}

How to use it

Pick the model and agent that match the task pressure: coding, documents, automation or private local work.

Attach only the MCP servers needed for that workflow and verify permissions before exposing files or secrets.

Run the pack checklist before delivery so prompts, rules and validation steps stay consistent.