nemoclaw-maintainer-security-code-review

name	nemoclaw-maintainer-security-code-review
description	Review a PR, or a PR linked to an issue, for security risks. Check nine categories and report PASS, WARNING, or FAIL. Use when reviewing code for vulnerabilities, secrets, injection, authorization bypasses, or unsafe configuration. Trigger keywords - security review, code review, appsec, vulnerability assessment, security audit, review PR security.
user_invocable	true

Security Code Review

Review the changes in a GitHub PR for security. An issue input must identify one open linked PR. Report a verdict for each category.

Prerequisites

• gh (GitHub CLI) must be installed and authenticated.
• git must be available.
• Network access to clone repositories and fetch PR metadata.

Step 1: Parse the GitHub URL

If the user gives a PR or issue URL, extract the owner, repository, and number. Otherwise, ask for the URL.

Supported URL formats:

• https://github.com/OWNER/REPO/pull/NUMBER
• https://github.com/OWNER/REPO/issues/NUMBER

For a PR URL, verify the number before Step 2:

gh pr view <number> --repo OWNER/REPO --json number,url

For an issue URL, list its open closing PRs:

gh issue view <number> --repo OWNER/REPO --json closedByPullRequestsReferences \
  --jq '.closedByPullRequestsReferences | map(select(.state == "OPEN")) | .[].number'

Continue only when this returns one PR number, and verify that number with . If it returns zero or more than one, stop and ask for the PR URL. Use the verified PR number in each later command.