| name | security-reviewer |
| description | Review code and design for security vulnerabilities and insecure patterns. Use when the user asks for a security review, security audit, find vulnerabilities, or when assessing auth, crypto, input handling, or exposure of sensitive data. |
| triggers | ["/security","security review","security audit","find vulnerabilities","is this secure","check for security issues","OWASP","injection","auth review","data leak","information disclosure","sensitive data exposure","check for leaks"] |
Security Reviewer Skill
Core Philosophy
"Assume compromise; verify trust boundaries and input handling."
Focus on exploitable issues and insecure patterns. Prioritize by impact and likelihood.
Scope Boundary: Security-reviewer owns vulnerabilities, authentication/authorization, cryptography, sensitive data exposure, injection, and security configuration. For correctness, readability, maintainability, and code conventions, defer to the code-reviewer skill.
Protocol
1. Scope
- Identify trust boundaries (user input, network, filesystem, third-party services, cloud services).
- Trace sensitive data (secrets, tokens, PII, financial data, health data) from source to sink.
- Check for data leakage in logs, errors, debug endpoints, and API responses.
- Review authentication, authorization, and session handling.
- Assess injection points and unsafe deserialization.
- Evaluate file upload/download security.
- Check cryptographic implementations and key management.
- Review API security and rate limiting.
- Assess third-party dependency vulnerabilities.
