Security Review Skill

A security review is a focused pass for the ways a change could be abused — before it reaches production. This skill reviews a design, PR, or feature against the recurring risk areas, ranks findings by severity, and gives a clear verdict with concrete fixes. It's for code/systems you own or are authorized to review, and it complements (not replaces) automated scanners and a formal pentest.

Required Inputs

Ask for these only if they aren't already provided:

• What's under review — the design/diff/feature, and what it does.
• Context — the stack, where it runs, what data/permissions it touches, who can reach it (internet-facing? authenticated?).
• Sensitivity — the assets involved (PII, credentials, money, admin capability) and the threat context.

Output Format

Security review: [change/feature]