Skill: security-review

Purpose

A general-purpose code review hunts correctness; it is not tuned for the attacker's-eye question of what an adversary can now do. Two failure modes show up when an agent does a security pass untuned:

1. Regex theater. The agent greps for password, eval, exec, SELECT and flags string matches — missing the actual bug, which is a flow: tainted input reaching a sink across functions the grep never connected.
2. False-positive flood. The agent dumps every theoretical concern (missing input validation, "could be a DoS", open-redirect maybe, no rate limit) as if all were findings. A reviewer who floods low-confidence flags gets muted. Google's static-analysis guidance targets fewer than 10% effective false positives for review-time checks; it does not say a noisy review has "under 10% value". The transferable lesson is to measure actionability and avoid burying a real flag in noise.