security-review

name	security-review
description	Review code or plans for OWASP-minded security risks, secret handling, authorization gaps, data exposure, and unsafe operational assumptions. Use for security audits or sensitive changes.

Security Review

Use this skill when the task is primarily a security audit or when a change touches auth, permissions, secrets, or data exposure.

Workflow

1. Gather the relevant diff and runtime context.
2. Review authentication, authorization, input handling, output handling, and secrets.
3. Run non-mutating package or dependency audit commands when the diff changes package manifests or lock files, or when the user requested a dependency audit. Prefer the repo's documented commands when available.
4. Use enabled MCP context only when it helps validate security-sensitive behavior or sanity-check a threat model on tricky code.
5. Report findings by severity with concrete remediation. Include None found for any severity category you include that has no issues.

Relevant MCP Skills

• mcp-context7 for current security guidance in frameworks
• mcp-github for PR, issue, advisory, or workflow context
• mcp-sentry for security-relevant production failures
• mcp-open-bridge for second-pass threat modeling and focused review of suspicious logic or diffs

Output

Report:

• Critical findings
• High-risk findings
• Medium-risk findings
• Low-risk findings
• Improvements
• Verification or audit commands run