Security review

Use this skill when changes touch sensitive behavior or external input.

Workflow

1. Identify assets, trust boundaries, and user-controlled input.
2. Trace data flow through validation, auth, storage, and output.
3. Check for practical exploit paths, not theoretical noise.
4. Separate confirmed findings from assumptions.
5. Recommend concrete fixes and tests.
6. State residual risk.
7. For Standard or sensitive work, write a security report under .kavion/reports/.

Review checklist