RetentaSecurity skills give an agent a method instead of a vibe: what to look for, how to tell a real finding from noise, and what to write down. The skills here cover threat models, GitHub Actions supply-chain risks and static analysis.
A skill that reviews code for vulnerabilities is not itself a security verification. These records describe each skill's method from its source; none claims the skill found or missed anything in practice.
OpenAI · Codex
A repository-grounded AppSec workflow for trust boundaries, assets, attacker capabilities, abuse paths, prioritized risk, and evidence-linked mitigations.
GitHub awesome-copilot (contributed by AmirhosseinHonardoust) · GitHub Copilot (VS Code / Copilot CLI)
A security reviewer for .github/workflows files that reasons about the Actions threat model: script injection from untrusted ${{ }} inputs, privileged triggers (pull_request_target, workflow_run, issue_comment) running fork code, mutable action references vs SHA pinning, over-scoped GITHUB_TOKEN permissions, OIDC and secret handling. Findings follow a bundled report format.
Sentry · Claude Code · Cursor · GitHub Copilot · Cline · any Agent Skills client via npx skills
An exploitation-focused GitHub Actions review: every finding must come with a concrete attack scenario or it is not reported. References encode real attack patterns (pwn requests, expression injection, comment-triggered commands, credential escalation, AI prompt injection via CI, runner infrastructure, supply chain) drawn from the 2025 'HackerBot Claw' campaign analysis.
OpenAI · OpenAI Codex ($skill-installer)
Produces a repository-grounded AppSec threat model in Markdown: the agent extracts components, data stores and integrations from the code, enumerates trust boundaries, assets, attacker capabilities and abuse paths, and proposes mitigations, anchoring every claim to repo evidence and keeping assumptions explicit. It only triggers on an explicit threat-modeling request and follows a bundled output template.
Trail of Bits · Claude Code (plugin marketplace) · OpenAI Codex (agents/openai.yaml bundled) · Antigravity
Runs a Semgrep security scan end to end: detects languages, selects rulesets, presents the plan for explicit user approval, then executes every approved ruleset through a bundled script (metrics off, batched processes) and merges results into one SARIF file. Supports 'run all' and 'important only' (medium-to-high confidence/impact) modes and uses Semgrep Pro cross-file taint analysis when available.
Eligible reviewed snapshots can be added to a Thyme RAG Capsule in one click. Retenta only enables that action after a separate capsule-distribution check; other records link to the publisher's installation path.