Security

This skill adds security-specific guidance.

Default Stance

• prioritize realistic attacker goals, attacker-controlled input, and concrete impact
• ground claims in actual code, entrypoints, data flows, trust boundaries, and deployment shape
• research the broader repo before reporting a vulnerability; do not flag pattern matches in isolation
• report high-confidence exploit paths first and separate them from lower-confidence follow-up checks
• prefer secure defaults that do not silently break intended behavior; call out meaningful tradeoffs
• separate runtime risk from CI/build/dev/test-only concerns

Use This Skill For

• security reviews, vulnerability audits, OWASP-style review requests, and secure-by-default coding help
• high-risk changes where the main question is whether a boundary is secure: authz, untrusted input, external fetches, uploads, secrets handling, sensitive data, or tenant isolation
• threat modeling a repo, service, or path