Security Code Review
Run a security-focused review using 5 security checklists via the senior-review-specialist agent.
Instructions
Spawn the senior-review-specialist agent to perform this review.
Checklists to Apply
Load and apply these review checklists:
commands/review/security.md - Vulnerabilities, insecure defaults, missing controlscommands/review/privacy.md - PII handling, data minimization, compliancecommands/review/infra-security.md - IAM, networking, secrets, configurationcommands/review/data-integrity.md - Data correctness over time, failures, concurrencycommands/review/supply-chain.md - Dependency risks, lockfiles, build integrity
Agent Instructions
The agent should:
- Get working tree changes: Run
git diff to see all changes
- Map threat surface:
- Identify entry points (HTTP handlers, CLI, webhooks)
- Identify trust boundaries (user input, DB, external APIs)
- Identify assets at risk (credentials, PII, financial data)
- For each changed file:
- Read the full file content
- Go through each diff hunk
- Apply all 5 security checklists
- Look for OWASP Top 10 vulnerabilities
- Cross-reference related files: Trace data flow, check auth
- Find ALL security issues: Security bugs are critical
Output Format
Generate a security review report with:
- Critical Issues (BLOCKER): Security vulnerabilities that must be fixed
- High Risk Issues: Significant security concerns
- Medium Risk Issues: Security improvements recommended
- Threat Surface Analysis: Entry points, trust boundaries, assets
- Security Posture: Authentication, authorization, input validation assessment
- File Summary: Security issues per file
- Overall Assessment: Secure/Not Secure recommendation with rationale
1---2name: review-security3description: Security-focused review covering vulnerabilities, privacy, infrastructure security, data integrity, and supply chain. Spawns the senior-review-specialist agent for thorough security analysis.4---5
6# Security Code Review
7
8Run a security-focused review using 5 security checklists via the senior-review-specialist agent.
9
10## Instructions
11
12Spawn the `senior-review-specialist` agent to perform this review.
13
14## Checklists to Apply
15
16Load and apply these review checklists:
17
18- `commands/review/security.md` - Vulnerabilities, insecure defaults, missing controls
19- `commands/review/privacy.md` - PII handling, data minimization, compliance
20- `commands/review/infra-security.md` - IAM, networking, secrets, configuration
21- `commands/review/data-integrity.md` - Data correctness over time, failures, concurrency
22- `commands/review/supply-chain.md` - Dependency risks, lockfiles, build integrity
23
24## Agent Instructions
25
26The agent should:
27
281. **Get working tree changes**: Run `git diff` to see all changes
292. **Map threat surface**:
30 - Identify entry points (HTTP handlers, CLI, webhooks)
31 - Identify trust boundaries (user input, DB, external APIs)
32 - Identify assets at risk (credentials, PII, financial data)
333. **For each changed file**:
34 - Read the full file content
35 - Go through each diff hunk
36 - Apply all 5 security checklists
37 - Look for OWASP Top 10 vulnerabilities
384. **Cross-reference related files**: Trace data flow, check auth
395. **Find ALL security issues**: Security bugs are critical
40
41## Output Format
42
43Generate a security review report with:
44
45- **Critical Issues (BLOCKER)**: Security vulnerabilities that must be fixed
46- **High Risk Issues**: Significant security concerns
47- **Medium Risk Issues**: Security improvements recommended
48- **Threat Surface Analysis**: Entry points, trust boundaries, assets
49- **Security Posture**: Authentication, authorization, input validation assessment
50- **File Summary**: Security issues per file
51- **Overall Assessment**: Secure/Not Secure recommendation with rationale
majiayu000