Skill: security-review

Purpose

A general-purpose code review hunts correctness; it is not tuned for the attacker's-eye question of what an adversary can now do. Two failure modes show up when an agent does a security pass untuned:

1. Regex theater. The agent greps for password, eval, exec, SELECT and flags string matches — missing the actual bug, which is a flow: tainted input reaching a sink across functions the grep never connected.
2. False-positive flood. The agent dumps every theoretical concern (missing input validation, "could be a DoS", open-redirect maybe, no rate limit) as if all were findings. A reviewer who floods low-confidence flags gets muted — a check that fires on noise has under ~10% effective value and developers stop reading it. At that point the security review is worse than none, because it buries the one real flag.