| name | security-review |
| description | Use this skill when the user asks for a security review, mentions auth/authz concerns, input validation, secret handling, SSRF, unsafe external calls, or wants a stricter review of a Symfony/API Platform change. Also trigger on phrases like "is this secure", "check the security of", "could this be exploited", or "are there vulnerabilities here". |
| allowed-tools | Read, Grep, Glob |
Security Review
Use this skill to review a change with a security-first lens.
Read first:
.claude/rules/security.md.claude/rules/architecture.md.claude/rules/testing.md
Read as needed:
.claude/patterns.md- the relevant diff and nearby files
Workflow:
- Inspect authentication and authorization boundaries.
- Check input validation before side effects.
- Check secrets, outbound calls, and user-controlled remote targets.
- Check output exposure and error leakage.
- Check negative-path tests for forbidden or invalid behavior.
Response format:
- findings first, ordered by severity
- then assumptions or open questions
- then a short hardening summary
Rules:
- Tie each finding to a concrete code path.
- Prefer actionable security findings over generic warnings.
