maragudk Security review
Getting started
Pick a random starting point by running the bundled script. Prefix scripts/random-file.sh with this skill's base directory, the absolute path stated when the skill loads:
bash /path/to/skill/scripts/random-file.sh
Run it from the project root: the script samples whatever directory it runs in, and scripts/ belongs to this skill rather than the project.
The random entry point is intentional: it forces exploration of parts of the codebase that might otherwise be overlooked. The idea is to run this skill multiple times over the life of a project, each time pulling one thread from a different starting point.
Read the file the script returned. From there, follow one promising path -- a single thread of connections (imports, callers, callees, data flow) that looks like it could harbor a security issue. Go deep on that one path rather than trying to survey everything.
Reporting
Report exactly one finding -- the single most significant security issue you discovered along the path. Not two, not a list, just one. If nothing concerning was found, say so -- that's a valid outcome. Resist the temptation to pad the report with minor observations or informational notes.
- Starting point: which file the review began from
- Path followed: the chain of files you traced and why you chose that direction
- Finding: severity, file and line number, description, and suggested fix