Review Software Security

Run this workflow only when the user explicitly invokes this skill by name. A related keyword or an ordinary implementation request is not an invocation.

Establish the authorized repository/design, deployed versions, entrypoints, assets, actors, privileges, and review depth. Distinguish a design threat from an observed implementation defect. Missing deployment facts are unknowns, not proof that a control is absent. Do not turn a review into an unsolicited rewrite.

Read only the relevant guidance:

• Threat review and evidence: model boundaries, prioritize reachable failures, and report findings with reproducible evidence.
• Trust-boundary checks: authorization, input, identity, storage, network, and native-code hazards.
• Supply chain and agent tools: dependency identity, artifact provenance, secrets, and untrusted instructions.