Security Review Skill

Goal: find exploitable vulnerabilities. Report only findings with high confidence.

Scope: Research vs Reporting (Mandatory)

• Report scope: only user-requested files/diff/component.
• Research scope: whole codebase as needed to confirm exploitability.

Before reporting, verify:

• true input source (attacker-controlled vs server-controlled)
• upstream validation/sanitization
• framework default protections
• relevant config/middleware/infra behavior