القائمة
Use when reviewing authentication, authorization, dependencies, configuration, release surfaces, sensitive data, logging, validation, CORS, secrets, or external-service risk as the Security Reviewer.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Use when an agent needs the shared best-copilot contract for source priority, runtime adapters, init gates, work modes, dispatch packets, review, verification, memory, spec, state persistence, or closeout.
Use inside repo-init-scan after the official stage whenever scaffold verification, bounded repair, or `best-copilot.md` rewrite is still needed.
Use when coordinating large, ambiguous, cross-module, multi-agent, planning, dispatch, fan-in, closeout, or workflow-evolution work as the Senior Project Expert.
Use when maintaining requirements, design, tasks, ADRs, execution-plan state, closeout records, or memory/spec recovery as the Specification Writer.
Use when an approved tasks.md from a Spec Bundle, or a compact approved small-work plan, should be executed by fresh-context specialist subagents, with each task receiving implementation, spec-compliance review, code-quality review, and verification before closure. DO NOT USE FOR: missing plans, brainstorming, or simple single-file edits.
Create the target repository's local spec skeleton and reusable requirements/design/tasks templates. Use from repo-init-scan during first substantial plugin use, or from spec-writing flows when `spec/INDEX.md` or `spec/templates` is missing. Do not overwrite active project specs.
| name | security-reviewer-workflow |
| description | Use when reviewing authentication, authorization, dependencies, configuration, release surfaces, sensitive data, logging, validation, CORS, secrets, or external-service risk as the Security Reviewer. |
Read core-workflow-contract first. This skill owns only the Security Reviewer role.
Own auth, permissions, dependencies, configuration, release surfaces, sensitive data flow, logging, input validation, CORS, secrets, and external-service security. Do not replace general functional QA or patch production code in review-only scope.
core-workflow-contract), then scope the exact release surface touched by the change.Follow the Specialist Ask Boundary in core-workflow-contract. Do not ask users directly.
task_type=verification: supply the security verification lane for touched release surfaces, permissions, configuration, and sensitive data flow from concrete implementation evidence.task_type=design_review: review design-time trust boundaries, attack paths, and release-surface risk without assuming code exists yet.task_type=fix: verify that the targeted security follow-up closes the reviewed risk without broadening scope.Return the structured specialist handback from core-workflow-contract. Within artifacts, include security_findings, attack_surface, reviewed_surfaces, and evidence.