security-review

Paths below are relative to this skill's directory.

Scope

Defensive security auditing of a whole codebase, a feature, or a named threat surface: scoping and coverage, threat modelling, access control, injection and deserialization, SSRF and trust between services, secrets and their rotation, dependency and supply-chain risk, turning findings into semgrep rules, severity, and keeping false positives out of the report.

Reviewing a diff for general correctness and style is the code-review skill's job; auditing a whole codebase, feature or threat surface is this skill's. That skill already carries the delta-shaped security pass — risk-classifying changed files, blaming removed guards, sizing blast radius — so a pull request under review goes there and comes back here when the question becomes "is this whole surface sound".