Set policy, review configurations and keep sessions safe.
Find high-confidence vulnerabilities in changed code.
/security-review: The /security-review command is in public preview.
/security-review
Outcome: Findings with severity, confidence and suggested fixes.
Check every github-app.yml for risky scripts.
Review .github/github-app.yml in this repository. For each script, explain what it runs, what network and credential access it needs, and whether it downloads and executes remote code. Flag anything that should require security sign-off and propose safer alternatives.
Outcome: A risk review of every script that runs with GitHub credentials.
Decide where local sandboxing or cloud sandboxes fit.
Cloud sandbox: Cloud sandboxes are in public preview, and an admin may need to enable them for your organization or enterprise.
Based on this repository's build, test and dev server needs, recommend whether sessions should default to a local sandbox or a cloud sandbox. List the network hosts and file paths the agent needs, and anything that should stay blocked.
Outcome: A documented sandbox default with a network allow list.
Give each automation the least access it needs.
Review this automation prompt and list the minimum tools it needs to succeed. Mark each tool as read or write, explain why it is needed, and suggest how to split the automation if write access is only needed for one step. <paste automation prompt>
Outcome: A least-privilege tool list for every automation you approve.
Assess what data a requested integration can read and change before anyone authorizes it.
Connectors: Connectors may not be on for your account yet. If they are not in the Customize view, add the service as an MCP server where your admin allows it, or attach an export.
A team wants to add the <name> connector. Summarize what data it can read and write, how it authenticates, where data leaves our network and what a misused prompt could do with it. Recommend approve, approve with limits or reject.
Outcome: A consistent review record for every integration request.
Moves:Toil hours
Upgrade flagged packages with tests passing.
Cloud sandbox: Cloud sandboxes are in public preview, and an admin may need to enable them for your organization or enterprise.
Find dependencies in this repository with known vulnerabilities. Upgrade each to the lowest fixed version, run the test suite after each upgrade, and stop to report if an upgrade needs code changes beyond a few lines.
Outcome: Patched dependencies with green tests, or a clear report on the hard ones.
Moves:Vulnerability fix time