Kiss Security Review

User Input

$ARGUMENTS

Audience and tone (interactive mode)

When KISS_AGENT_MODE=interactive (the default), assume the user has limited technical background and limited domain knowledge — they may know basics but lack deep expertise in this skill's area. Run this skill as a guided questionnaire:

• One question at a time. No walls of questions.
• Yes / no first. Phrase so yes, no, not sure, or skip is a valid answer.
• Translate jargon, don't strip it. Use the technical term but always pair it with a plain-English gloss the first time it appears.
• Choices, not blank fields. When yes/no isn't enough, offer 2-4 lettered options (A/B/C/D) with one-line plain-language descriptions of the trade-off. Always include "Not sure — pick a sensible default".
• Always recommend. State the option you would pick and why in one sentence so the user can reply "yes" / "ok" to accept. Pull defaults from upstream artefacts (spec, architecture, ADRs, standards) before asking blank.
• Show, don't ask. When upstream artefacts already imply an answer, propose it as a pre-filled finding and ask for a yes / no confirmation rather than asking the user to fill in a blank.
• not sure / skip triggers a sensible default, marked "(default applied — confirm later)" in the artefact, and a debt entry in this skill's debt file.

When KISS_AGENT_MODE=auto (or --auto), skip the questionnaire entirely: apply sensible defaults from upstream artefacts and log decisions to the parent agent's decision log.

Inputs

• .kiss/context.yml
• Source files changed for current.feature
• {context.paths.docs}/architecture/c4-container.md (attack surface)
• {context.paths.docs}/architecture/intake.md (compliance regime)
• {context.paths.docs}/decisions/ADR-*.md (auth / crypto choices)

Outputs

• {context.paths.docs}/reviews/<feature>/security.md
• {context.paths.docs}/reviews/security-debts.md (append, shared across features)

Context Update

Does not mutate .kiss/context.yml.

Handoffs

• kiss-dependency-audit complements with third-party CVE scan.
• bug-fixer reads Critical / High severity findings.
• kiss-status-report reads security-debts.extract for escalations.

AI authoring scope

Does: walk each OWASP Top 10:2025 category against the feature's code and config, identify specific file:line findings, outline remediation per finding, and link to authoritative references (OWASP cheat sheet, CWE catalogue).

Does not: run exploits; pentest live systems; commit to a "secure / insecure" label without stated assumptions; modify code.

Usage

<SKILL_DIR> = the integration's skills root (e.g. .claude/skills/ for Claude Code, .agents/skills/ for Antigravity / Codex, .cursor/skills/ for Cursor, .windsurf/workflows/ for Windsurf). Scripts live at <SKILL_DIR>/<skill-name>/scripts/….

SR_COMPLIANCE="gdpr,soc2" bash <SKILL_DIR>/kiss-security-review/scripts/bash/review.sh --auto

Answer keys

References

• references/owasp-top10-2025.md — the ten categories + smell patterns + remediation outlines.
• references/stride-guide.md — STRIDE threat-modelling questions.