Menu
Use when reviewing authentication, authorization, dependencies, configuration, release surfaces, sensitive data, logging, validation, CORS, secrets, or external-service risk as the Security Reviewer.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | security-reviewer-workflow |
| description | Use when reviewing authentication, authorization, dependencies, configuration, release surfaces, sensitive data, logging, validation, CORS, secrets, or external-service risk as the Security Reviewer. |
Read core-workflow-contract first. This skill owns only the Security Reviewer role.
Own auth, permissions, dependencies, configuration, release surfaces, sensitive data flow, logging, input validation, CORS, secrets, and external-service security. Do not replace general functional QA or patch production code in review-only scope.
core-workflow-contract), then scope the exact release surface touched by the change.Follow the Specialist Ask Boundary in core-workflow-contract. Do not ask users directly.
task_type=verification: supply the security verification lane for touched release surfaces, permissions, configuration, and sensitive data flow from concrete implementation evidence.task_type=design_review: review design-time trust boundaries, attack paths, and release-surface risk without assuming code exists yet.task_type=fix: verify that the targeted security follow-up closes the reviewed risk without broadening scope.Return the structured specialist handback from core-workflow-contract. Within artifacts, include security_findings, attack_surface, reviewed_surfaces, and evidence.
Use when an agent needs the shared best-copilot contract for source priority, runtime adapters, init gates, work modes, dispatch packets, review, verification, memory, spec, state persistence, or closeout.
Use inside repo-init-scan after the official stage whenever scaffold verification, bounded repair, or `best-copilot.md` rewrite is still needed.
Use when coordinating large, ambiguous, cross-module, multi-agent, planning, dispatch, fan-in, closeout, or workflow-evolution work as the Senior Project Expert.
Use when maintaining requirements, design, tasks, ADRs, execution-plan state, closeout records, or memory/spec recovery as the Specification Writer.
Use when an approved tasks.md from a Spec Bundle, or a compact approved small-work plan, should be executed by fresh-context specialist subagents, with each task receiving implementation, spec-compliance review, code-quality review, and verification before closure. DO NOT USE FOR: missing plans, brainstorming, or simple single-file edits.
Create the target repository's local spec skeleton and reusable requirements/design/tasks templates. Use from repo-init-scan during first substantial plugin use, or from spec-writing flows when `spec/INDEX.md` or `spec/templates` is missing. Do not overwrite active project specs.