security-review

name	security-review
description	Review code changes for security vulnerabilities before they are committed or merged. Triggers automatically when auth or security files are modified, or when a PR targets the main branch.
trigger	[{"files_modified":["**/auth/**","**/security/**","**/middleware/**"]},{"pr_target":"main"}]

Security Review

Purpose

Catch security vulnerabilities before code reaches production. This skill reports findings only — it does not modify code.

When this runs

• Any file in /auth, /security, or /middleware is modified
• A PR targeting the main branch is opened or updated
• A human explicitly requests a security review

What it checks

1. Authentication and authorisation bypass vulnerabilities
2. Injection risks — SQL, command, XSS, template injection
3. Insecure direct object references (IDOR)
4. Secrets or credentials hard-coded in source files
5. Dependency vulnerabilities (if a manifest file changed)
6. Insecure defaults (e.g. CORS wildcards, missing CSRF protection)

Output

A findings list with:

• Location — file and line number
• Severity — CRITICAL / HIGH / MEDIUM / LOW
• Description — what the vulnerability is and why it matters
• Remediation — specific, actionable fix

Rules

• CRITICAL findings block the workflow — the task must not proceed until they are resolved or explicitly overridden by a human
• HIGH findings require acknowledgement — a human must confirm they have read the finding before the workflow continues
• This skill does not modify any files — it reports only
• If no issues are found, output: Security review passed — no issues found