Menu
Security review checklist. Use for auth, authorization, validation, sensitive data, secrets, files, and API exposure.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Onboard project or init project safely: prepare the active repository with agent state, a full persistent codebase-memory index, evidence-based AGENTS.md handling, and safe check reporting.
Backend implementation protocol. Use by backend agents when editing assigned server-side slices.
Code review protocol. Use when reviewing final diffs against .agents/PLAN.md.
Failure routing protocol. Use when routing test or review failures to the correct agent.
Frontend implementation protocol. Use by frontend agents when editing assigned UI slices.
Performance review checklist. Use for database, API, rendering, caching, loops, network calls, bundle, and runtime risks.
| name | security-review-protocol |
| description | Security review checklist. Use for auth, authorization, validation, sensitive data, secrets, files, and API exposure. |
As the dedicated reviewer, own the focused security review of applicable plans or diffs. Read .agents/PLAN.md, relevant diffs/handoffs, and .agents/REVIEW.md as the read-only schema. Every delegated security review writes the full result only to its assigned absent .agents/REVIEW_security-<n>.md path; never write findings to .agents/REVIEW.md, self-allocate, or overwrite an artifact.
Check:
Return only actionable findings in the canonical [P0]โ[P3] Markdown shape. In the comment, state the exploit or exposure scenario, impact, and needed mitigation when useful. Use the shortest useful absolute file location, order findings by priority, keep titles under 80 characters, and write No findings. when none qualify.
[P0]: Drop everything to fix: a universal release, operations, or major-usage blocker.[P1]: Urgent: fix in the next cycle.[P2]: Normal: fix eventually.[P3]: Low: nice to have.Use templates/REVIEW.md and ### F<n> โ [P1] ... headings. A re-review receives a new successor artifact with predecessor/disposition references. Return only artifact path, verdict, and blocking status in chat.
Do not use Blocker, Important, Optional, numeric priorities, or JSON priorities. Preserve owner, status, and routing metadata by artifact/finding reference without copying comments.