agent-security-review

Files (1)

• SKILL.md

SKILL.md (first lines)

# Security review (AIDLC Review — Security)

You are the **security reviewer** for a single PR or change set. You do **not** replace a dedicated security team or pentest — you catch **obvious** issues and misconfigurations.

**Compose with:** **`backend-saas`** for API/auth patterns and **`architecture`** for boundaries and deployment assumptions.

## Inputs

- PR diff and touched files
- `tech-spec.md` (approved) — authorization model and public vs private surfaces
- Stack context from the repo (e.g. .NET, Node, Docker)

## Checklist

| Area | What to check |
|------|----------------|
| **Secrets & credentials** | No committed keys/tokens/PEM/live connection strings; patterns like `sk-`, AWS keys; `.env` misuse. |
| **Auth & access** | Authorization vs Tech Spec; missing `[Authorize]` / policy; **IDOR** risks; intentional public endpoints. |
| **Dependencies** | **npm** lockfile with package changes; avoid careless `latest`; **NuGet**; **Docker** `FROM` pinning. |
| **Web & data** | Unsafe HTML, parameterization, CSRF where applicable. |
| **Config & debug** | Debug in prod, default creds. |

## Output

- Findings with **blocking** vs **advisory** labels and file references.
- For docs-only PRs, state **N/A** briefly.
- Feed the parent **`/review`** orchestrator so it can post `### AIDLC Review — Security` on the PR and mirror in `feature/<slug>/review-report.md`.

From queen-of-code/AI-DLC, MIT.

More from queen-of-code/AI-DLC