| 1 | --- |
| 2 | name: security-review |
| 3 | description: Review trust boundaries, auth/authz, injection, secrets, filesystem/network exposure, dependencies, and exploitability without pretending a shallow lint is an audit. |
| 4 | invocation: model+user |
| 5 | --- |
| 6 | |
| 7 | # Security Review |
| 8 | |
| 9 | ## When to use |
| 10 | Use when looking for vulnerabilities, auth holes, secret leaks, or unsafe trust boundaries. |
| 11 | |
| 12 | ## Non-goals |
| 13 | - This is not a formal audit certificate. |
| 14 | - Do not claim exploitability without evidence. |
| 15 | |
| 16 | ## Workflow |
| 17 | 1. Map trust boundaries and entry points. |
| 18 | 2. Check auth/authz, injection, secrets, FS/network exposure, deps. |
| 19 | 3. Rank findings by exploitability and impact. |
| 20 | 4. Recommend fixes and verification steps. |
| 21 |