security-review

name	security-review
description	Lightweight security review focused on Pull Requests and incremental changes. Uses a diff-centric approach to ensure no new vulnerabilities are introduced. You MUST load this skill when reviewing code changes in a PR.
license	MIT

Security Review Skill

This skill provides a focused, diff-centric approach to security reviews. Unlike a full security audit, a review focuses on identifying vulnerabilities introduced by specific changes (Pull Requests).

When to Use

Use this skill when:

• Reviewing a Pull Request for security implications.
• Conducting a quick check on a specific diff or a few files.
• Responding to a /security-review command on a PR thread.
• You need to verify that new code follows secure coding practices.

When Not to Use

• When asked to perform a deep, repository-wide scan (use security-audit).
• When performing architectural threat modeling from scratch.

Review Mindset

• Focus on the Diff: Prioritize code added or modified in the current change set.
• Regression Prevention: Ensure no existing security controls are removed or weakened.
• Incremental Risk: Ask "What new attack surface does this change expose?"

Review Workflow

1. Analyze the Diff: Read the changed files and identify new entry points or data sinks.
2. Check for Low-Hanging Fruit:
   • Hardcoded secrets in the diff.
   • New dependencies with known vulnerabilities.
   • Unsanitized user input in new endpoints.
3. Verify Security Logic: If the PR touches auth or crypto code, verify it against security-audit references.
4. Provide Contextual Feedback: Comment directly on the lines of code where issues are found.

Output Format

For PR reviews, provide a concise summary of findings. Use the format defined in references/report-format.md.

Related Skills

• github-pr-review
• security-audit