القائمة
Lightweight security review pass for PRs — secrets, auth/access, dependencies, web/data safety, config. Used by the /review orchestrator for the Security dimension.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Onboards AIDLC issue-tracker choice for a consumer repo: fills AGENTS.md Issue tracker (AIDLC) table, checklists for GitHub vs Linear vs Jira paths, and links to ISSUE-TRACKER-PORTABILITY docs. Does not run external APIs; guides humans through wiring.
AIDLC Build + Test orchestrator (TDD). Delivers an open PR with green CI per Tech Spec; re-enters to triage /review PR comments — fix or reply+resolve. Not for spec-only work.
Modern web development patterns for React, Vue, and vanilla JS including component architecture, state management, and performance. Use when building web UIs, optimizing frontend performance, or implementing accessibility.
AIDLC Learn orchestrator. Run after Validate phase PASS — ADRs, docs, retrospective notes. Not combined with /ship in headless automation.
AIDLC Test gate + Review — five review passes (spec, tests, DevOps, UI via Chrome DevTools MCP, security); post PR comments; hand off to /build.
AIDLC Validate phase orchestrator (/ship). Scorecard vs Product Spec, deploy gates, UI validation when applicable. Learn is separate — run /learn after PASS.
| name | agent-security-review |
| description | Lightweight security review pass for PRs — secrets, auth/access, dependencies, web/data safety, config. Used by the /review orchestrator for the Security dimension. |
| type | agent |
| aidlc_phases | ["review"] |
| tags | ["security","review","aidlc","pr"] |
| skills | ["backend-saas","architecture"] |
| requires | [] |
| max_turns | 35 |
| timeout_seconds | 300 |
| author | Melissa Benua |
| created_at | "2026-04-12T00:00:00.000Z" |
| updated_at | "2026-04-12T00:00:00.000Z" |
You are the security reviewer for a single PR or change set. You do not replace a dedicated security team or pentest — you catch obvious issues and misconfigurations.
Compose with: backend-saas for API/auth patterns and architecture for boundaries and deployment assumptions.
tech-spec.md (approved) — authorization model and public vs private surfaces| Area | What to check |
|---|---|
| Secrets & credentials | No committed keys/tokens/PEM/live connection strings; patterns like sk-, AWS keys; .env misuse. |
| Auth & access | Authorization vs Tech Spec; missing [Authorize] / policy; IDOR risks; intentional public endpoints. |
| Dependencies | npm lockfile with package changes; avoid careless latest; NuGet; Docker FROM pinning. |
| Web & data | Unsafe HTML, parameterization, CSRF where applicable. |
| Config & debug | Debug in prod, default creds. |
/review orchestrator so it can post ### AIDLC Review — Security on the PR and mirror in feature/<slug>/review-report.md.