| name | security-review |
| description | Review code changes for security vulnerabilities before they are committed or merged. Triggers automatically when auth or security files are modified, or when a PR targets the main branch.
|
| trigger | [{"files_modified":["**/auth/**","**/security/**","**/middleware/**"]},{"pr_target":"main"}] |
Security Review
Purpose
Catch security vulnerabilities before code reaches production.
This skill reports findings only — it does not modify code.
When this runs
- Any file in
/auth, /security, or /middleware is modified
- A PR targeting the
main branch is opened or updated
- A human explicitly requests a security review
What it checks
- Authentication and authorisation bypass vulnerabilities
- Injection risks — SQL, command, XSS, template injection
- Insecure direct object references (IDOR)
- Secrets or credentials hard-coded in source files
- Dependency vulnerabilities (if a manifest file changed)
- Insecure defaults (e.g. CORS wildcards, missing CSRF protection)
Output
A findings list with:
- Location — file and line number
- Severity — CRITICAL / HIGH / MEDIUM / LOW
- Description — what the vulnerability is and why it matters
- Remediation — specific, actionable fix
Rules
- CRITICAL findings block the workflow — the task must not proceed
until they are resolved or explicitly overridden by a human
- HIGH findings require acknowledgement — a human must confirm
they have read the finding before the workflow continues
- This skill does not modify any files — it reports only
- If no issues are found, output:
Security review passed — no issues found
