code-security-review

name	code-security-review
description	Passive code-review lane for authorized repositories, local checkouts, uploaded source archives, and diffs. Use when the security research agent needs deterministic candidate discovery before expensive AI investigation, scoped PR-style review, append-only evidence records, or independent revalidation of code findings.

Code Security Review

Use this product-side skill for repository and diff analysis. The goal is to turn source files into durable candidate signals, then investigate only the most useful files with clear evidence and revalidation. This is a passive workflow unless the user explicitly approves build, test, shell, network, browser, or mutation actions.

Ground Rules

• Treat a repository, local checkout, source archive, or diff as authorized only for passive reading unless the user grants a broader action.
• Do not run install, build, test, scripts, hooks, or package-manager commands without approval.
• Prefer deterministic candidate discovery before model-heavy investigation.
• Keep project context short. Include target shape, key auth primitives, entry points, false-positive patterns, and priority paths; do not dump the full repo.
• Keep scan state append-only: rescans add history, investigations add analysis entries, revalidation annotates findings.
• Separate candidate signals from findings. A route handler, sink, or tool definition is a reason to review, not a vulnerability by itself.
• Revalidate candidate findings independently before marking them validated, remediated, or false positive.

Workflow

1. Scope. Identify repo/path/diff, target id, commit or artifact version, allowed actions, and whether this is a full pass or changed-file review.
2. Compact context. Summarize architecture, auth/session controls, data stores, agent/tool boundaries, priority paths, and known false positives in a short project context.
3. Candidate scan. Prefer passive matchers for entry points, auth boundaries, raw SQL, SSRF-like fetches, file writes, process execution, dangerous HTML, secret handling, and agent tool definitions.
4. Prioritize. Investigate precise candidates before normal and noisy candidates. In diff mode, still inspect changed files even when no matcher fires.
5. Investigate. For each file or small batch, produce evidence-backed draft findings, no-finding coverage notes, and missing-evidence questions.
6. Revalidate. Try to disprove each draft finding by rereading the code, checking guards/reachability, and looking for fixes. Mark true-positive, false-positive, fixed, uncertain, or duplicate.
7. Persist evidence. Save scan summaries, candidate manifests, analysis notes, and validated finding artifacts through the normal artifact and finding path.

Output

Return:

• Scope: repository/path/diff, target id, commit or artifact version, and passive/approved actions.
• Scan Summary: files considered, candidates by matcher/category/noise tier, clean changed files, and priority paths.
• Candidate Queue: ranked files with candidate reasons and exact paths/lines.
• Findings: draft or validated findings with evidence, confidence, severity, and revalidation state.
• No-Finding Coverage: files or entry points reviewed with no issue found.
• Next Steps: approval needs, follow-up matchers, validation plans, patch candidates, or report-ready artifacts.