security-pr-reviewer

What problem does it solve?

This Skill reviews an actual code diff for security risk before merge, helping catch authorization gaps, injection flaws, secrets exposure, and control regressions that a general review might miss.

Core Features & Use Cases

• Diff-Driven Security Review: Analyzes a real PR, branch delta, staged changes, or commit diff rather than a verbal description.
• Authorization and Tenant Checks: Verifies object-level authorization and server-derived tenant scoping on SaaS data paths, including anti-IDOR checks.
• Injection and Secret Hunting: Looks for SQL, NoSQL, shell, template, deserialization, SSRF, redirect, and secrets handling issues.
• Security Verdicts: Produces severity-ranked findings with file and line evidence, exploit paths for high-severity issues, remediation guidance, and an approve or request-changes decision.
• Use Case: Use it when a PR adds a new endpoint, relaxes a security control, or touches auth, uploads, external calls, or data access logic.

Quick Start

Ask for a security review of the actual diff for your PR or branch and include the base ref so the Skill can inspect the changed files and return a verdict with evidence.