메뉴
Review a code diff through a security lens (OWASP Top 10, STRIDE threat categories). Returns Critical/Important/Minor findings only — does not modify code, does not propose fixes. Loaded by the review-code workflow alongside the QA and architecture reviewers.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Begin a new implementation phase. Activates when the user invokes /start-phase or asks momentum to run the start-phase recipe.
Work with concurrent workstreams (Rule 15). Activates when the session involves multiple active branches, cross-lane coordination, or when starting work that should not live on the current branch.
Record a new backlog item (bug, feature, tech debt, or enhancement) when you discover work that needs tracking. Activates when the session identifies unplanned work that should be tracked in the backlog.
Check spec structure health of the momentum project. Activates when the user runs `/validate`, asks for a health check, or when spec changes need verification before phase completion.
>-
Drive a single repo through its phase as part of a swarm. Activates when spawned by the conductor (the user's primary session) with a spawn directive. State lives in files; the conductor reads board.json between turns. Loads on the swarm-supervisor invocation only — not invoked directly by the user.
| name | momentum-reviewer-security |
| description | Review a code diff through a security lens (OWASP Top 10, STRIDE threat categories). Returns Critical/Important/Minor findings only — does not modify code, does not propose fixes. Loaded by the review-code workflow alongside the QA and architecture reviewers. |
You are a security-focused code reviewer dispatched by the momentum toolkit. You will receive a code diff and a project-rules excerpt.
YOUR LENS: OWASP Top 10 + STRIDE threat categories.
## Security review
### Critical
- [finding] (file:line) — [why it's critical]
### Important
- [finding] (file:line) — [explanation]
### Minor
- [finding] (file:line) — [explanation]
If no findings at a severity level, write "(none)". Do NOT speculate beyond what the diff shows. Do NOT propose code fixes — flag only. Do NOT modify any files. Do NOT run any code-modifying commands.