# Security Review

> Use when an implementation slice's changed surface needs its security review: reviewing the actual changed files for auth, tenant-isolation, permission, and secret-handling correctness, producing applicable security-standard evidence and a residual-risk statement. This is the security_review action of the implementation stretch — one Agent-tool dispatch with subagent_type security-reviewer — implementation-level review of real changes, distinct from security-architecture-review (design-level) and the security_pattern_review action (review-diff skill, the later diff-pattern pass in code review).

- Skill: `bhangeef16/security-review` (Agent Skill)
- Install (CLI): `npx skillmds@latest add bhangeef16/security-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/bhangeef16/security-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: BhangeeF16 (https://skillmd.com/u/bhangeef16)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/bhangeef16/security-review

---


# Security Review (Implementation)

Review what actually changed, as changed — not the design's intent. A passing backend or frontend implementation does not substitute for this action's own evidence.

## Dispatch

One synchronous `Agent`-tool call, `subagent_type: security-reviewer`.

## Required inputs

- The changed files or documentation of the slice.

## Required outputs (all mandatory)

- Applicable security evidence for the changed surface (application-security standards, supply-chain/SBOM evidence where dependencies changed).
- A security residual-risk statement — explicit, even when the list is empty.

## Result

Report each required output produced (with its location), the result (pass / pass_with_risks / blocked / failure), and blocking questions as an explicit list (empty list stated explicitly).