security-review

name	security-review
description	Run an OWASP-focused security analysis on code changes.

/security-review

Spawns the security-reviewer agent to perform a structured security analysis of your code changes.

Steps

1. Gather context — detect the scope of the security review:

   • If arguments are provided (file paths or PR number), scope to those
   • Otherwise, use git diff to determine changed files
   • Identify files touching auth, API endpoints, input handling, or secrets

2. Spawn the agent — use the Task tool:

   Task tool with subagent_type="security-reviewer"
   

   Pass in the prompt:

   • The diff or file contents to review
   • The list of changed files with categories (auth, API, data handling)
   • The project's language and framework for context-specific checks

3. Present findings — relay the agent's security report:

   • Group by severity: CRITICAL > HIGH > MEDIUM > LOW
   • Include exploit scenarios for each finding
   • Show recommended fixes with code references
   • Report secrets detection and dependency audit results

4. Offer follow-up actions:

   • "Fix critical issues?" — apply recommended security fixes
   • "Create issues for non-critical findings?" — track as GitHub issues
   • "Run dependency audit?" — check for known CVEs in dependencies