security-skills

Performs maximum-depth defensive security reviews using subagent planning, multi-phase investigation, and independent adversarial validation to minimize false positives. Use when findings drive shipping, compliance, or disclosure decisions and false positives must be rare — materially more expensive than code-review.

Performs full defensive security reviews of software repositories for vulnerabilities, authorization flaws, insecure data flows, and missing security tests. Use when reviewing a repo, application, service, codebase, PR, diff, or implementation plan.

Reviews PR or branch diffs, threat models the changed behavior, and reports net-new security vulnerabilities, correctness bugs, and operability regressions. Use for detailed security and correctness reviews of PRs, branches, patches, or diffs before merge.

Performs deep defensive reviews of authorization, access control, role boundaries, and tenant isolation. Use when testing for IDOR, BOLA, BFLA, privilege escalation, cross-tenant data access, or broken access-control regressions.

Reviews LLM and AI agent systems for prompt injection, unsafe tool use, context leakage, approval bypasses, and missing security tests. Use when auditing AI agents, MCP servers, tool routers, retrieval systems, or autonomous workflows.

Builds safe, authorized API abuse testing plans for applications. Use when testing APIs for broken access control, data exposure, unsafe input handling, replay, rate-limit gaps, or business logic abuse.

Orchestrates parallel security and code-quality audits for a branch or PR, deduplicates findings, and produces one prioritized merge-readiness list. Use when reviewing BASE...HEAD before merge.

Audits a branch or PR diff for maintainability, complexity, testability, and architecture regressions. Use when reviewing BASE...HEAD or PR diffs for code health issues before merge.

Maps codebase security controls to compliance frameworks (SOC 2, ISO 27001, NIST CSF, HIPAA, PCI-DSS) and identifies gaps and evidence issues. Use when preparing for an audit, assessing compliance posture, or mapping controls to framework requirements.

Triages cybersecurity findings for validity, exploitability, impact, and evidence quality. Use when reviewing vulnerability reports, scanner output, pentest findings, or bug bounty submissions.

Produces an executive security posture report for non-technical leaders by analyzing a target application or repository with deep appsec rigor. Use when creating board-ready, founder-facing, or customer-facing security reports.

Retests known findings against the current code using code review and targeted local smoke tests when possible. Use when validating whether reported issues are fixed or still reproducible.

Converts security findings, threat models, and suspected vulnerabilities into concrete regression tests. Use when adding tests that prove an application's security controls keep working.

Reviews dependencies, CI/CD, build scripts, release workflows, containers, and repository security settings for supply-chain and deployment risk. Use when testing software composition, vulnerable components, or build and release security posture.

Produces a professional red-team application security threat model as a standalone HTML report. Use when mapping architecture, data flows, trust boundaries, attack surface, and realistic abuse cases.