Security Review
Purpose
Identify plausible, evidence-backed security weaknesses across trust boundaries, attacker-controlled inputs, identities, secrets, data, and operational controls. Review is read-only.
Workspace protocol
Read references/workspaces.md once per agent task before selecting or creating workflow artifacts; reuse it unless repository scope or task authority changes. This skill owns only the task-specific behavior below.
Inputs
- Defined scope, threat assumptions, and deployment context
- Code, dependencies, configuration, infrastructure, schemas, and auth flows
- Existing security findings, tests, and compensating controls
Outputs
- Findings ordered by exploitability and impact, with evidence and attack path
- Affected assets, preconditions, remediation direction, and confidence
- Coverage limits and residual risks
Rules
- Read
references/finding-rubric.md before assigning finding severity; keep unsupported concerns and defense-in-depth opportunities separate from confirmed defects.
- Map trust boundaries and attacker capabilities before applying checklists.
- Check authentication, authorization, injection, XSS, CSRF, SSRF, secret handling, cryptography, data exposure, dependency risk, abuse controls, and logging where relevant.
- Never include live secrets, exploit unrelated systems, or perform destructive testing.
- Distinguish confirmed vulnerabilities from hardening opportunities.
- Do not edit code unless the user separately requests remediation.
Decision-log updates
Log only accepted security tradeoffs, threat-model assumptions, compensating controls, or risk acceptance decisions.
When durable state is approved, track sanitized vulnerabilities in the selected work item's findings.md and append accepted security tradeoffs, threat assumptions, compensating controls, or risk acceptance to decisions.md; otherwise report them in the final response.
Escalate to the human
Escalate immediately for plausible critical exposure, active compromise indicators, secrets in version control, testing that may affect real users, or remediation requiring risk acceptance. Avoid broadcasting sensitive details beyond the authorized audience.
1---2name: security-review3description: Use when security is the primary assessment objective for code, configuration, architecture, identities, data handling, or a change set; use review for a general defect review.4---56# Security Review78## Purpose910Identify plausible, evidence-backed security weaknesses across trust boundaries, attacker-controlled inputs, identities, secrets, data, and operational controls. Review is read-only.1112## Workspace protocol1314Read `references/workspaces.md` once per agent task before selecting or creating workflow artifacts; reuse it unless repository scope or task authority changes. This skill owns only the task-specific behavior below.1516## Inputs1718- Defined scope, threat assumptions, and deployment context19- Code, dependencies, configuration, infrastructure, schemas, and auth flows20- Existing security findings, tests, and compensating controls2122## Outputs2324- Findings ordered by exploitability and impact, with evidence and attack path25- Affected assets, preconditions, remediation direction, and confidence26- Coverage limits and residual risks2728## Rules2930- Read `references/finding-rubric.md` before assigning finding severity; keep unsupported concerns and defense-in-depth opportunities separate from confirmed defects.31- Map trust boundaries and attacker capabilities before applying checklists.32- Check authentication, authorization, injection, XSS, CSRF, SSRF, secret handling, cryptography, data exposure, dependency risk, abuse controls, and logging where relevant.33- Never include live secrets, exploit unrelated systems, or perform destructive testing.34- Distinguish confirmed vulnerabilities from hardening opportunities.35- Do not edit code unless the user separately requests remediation.3637## Decision-log updates3839Log only accepted security tradeoffs, threat-model assumptions, compensating controls, or risk acceptance decisions.40When durable state is approved, track sanitized vulnerabilities in the selected work item's findings.md and append accepted security tradeoffs, threat assumptions, compensating controls, or risk acceptance to decisions.md; otherwise report them in the final response.4142## Escalate to the human4344Escalate immediately for plausible critical exposure, active compromise indicators, secrets in version control, testing that may affect real users, or remediation requiring risk acceptance. Avoid broadcasting sensitive details beyond the authorized audience.
nono911