Security Review Skill

This skill ensures all code follows security best practices and identifies potential vulnerabilities.

Guardrails

• Define assets, actors, trust boundaries, and assumptions before recommending controls.
• Prefer the smallest mitigation that closes the verified risk. Do not add speculative security machinery.
• Do not rewrite unrelated auth, validation, or persistence code while fixing one issue.
• Verify security claims with tests, config checks, dependency evidence, or threat-model reasoning.

Required Companion Skill

Use /interrogate-me as part of this workflow before finalizing security guidance or sign-off. Let it stress-test the feature, assets, actors, trust boundaries, data flows, attacker goals, secrets, permissions, integrations, failure modes, and deployment assumptions one question at a time. Incorporate the resulting assumptions, decisions, risks, and unresolved issues into the security checklist, threat model, verification steps, and final recommendations.

When to Activate