nemoclaw-maintainer-security-code-review

Provide the PR URL in the format https://github.com/OWNER/REPO/pull/NUMBER. The Skill verifies the PR with the GitHub CLI, checks out the code, diffs it against the base branch, and reports a verdict for each of nine security categories.

Yes, but the issue must have exactly one open linked closing PR. The Skill lists the issue's open closing PRs via gh issue view; if it finds zero or more than one, it stops and asks for a direct PR URL.

The review covers nine categories: secrets and credentials, input validation, authentication and authorization, dependencies, error handling and logging, cryptography, configuration and security headers, security testing, and system security.

The GitHub CLI (gh) must be installed and authenticated, git must be available, and the environment needs network access to clone repositories and fetch PR metadata.

The Skill reviews files in priority order: authentication and credential handling first, then user input processing, configuration files, new dependencies, and finally everything else, ensuring security-critical surfaces are examined first.

The review stops if the PR has no changed files or no reviewable security surface. It is a static manual-style analysis guided by a checklist, so it does not execute code or run dynamic vulnerability scanners.