Menu
Review owned code or proposed changes for auth, data, secret, dependency, injection, or LLM security risks.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Produce and approve one lean living Feature Brief after $he selects lifecycle work.
Route explicit lifecycle requests or genuinely complex or high-risk staged work through one living Feature Brief.
Design or review DESIGN.md, UI tokens, and component ownership.
Run deterministic project gates, including worktree readiness.
Prove browser/device behavior and visual evidence.
Execute an approved PLAN one demonstrable vertical slice at a time until the actual implementation is green.
| name | security-review |
| description | Review owned code or proposed changes for auth, data, secret, dependency, injection, or LLM security risks. |
| Need | Load/action |
|---|---|
| Focused auth/data/injection/upload/secret/LLM path | Apply focused trace + report contract |
| Broad application/repository review | broad.md |
| Dependency/advisory exposure | dependencies.md + $research |
| Branch/PR/WIP security review | $code-review owns final axes/verdict; this skill supplies security evidence |
| Existing scanners/audits/CI | $deterministic-checks owns commands/results |
| Status | Boundary |
|---|---|
FAIL | Confirmed exploitable risk, exposed secret/data, broken trust boundary, or required evidence/gate failure |
CONCERNS | Material surface unverified, plausible path lacks decisive proof, or current dependency evidence unavailable |
PASS | Every scoped surface checked/N/A; no unresolved finding |
$test-quality + $deterministic-checks; never suppress evidence.