What problem does it solve? Delivered code often ships with injection vectors, authentication gaps, exposed secrets, or compliance violations that only surface after deployment. This Skill performs a code-level security review of a delivered ticket, cross-references compliance constraints, and records findings with severities, attack scenarios, and explicit risk-acceptance decisions. ## Core Features & Use Cases - OWASP-informed code review: Checks input validation, authentication and authorization, data protection, configuration, dependencies, cryptography, and logging against the OWASP Top 10:2025. - Severity-ranked findings with attack scenarios: Every Medium-or-higher finding includes a plausible attack scenario; compliance constraint (CC-XXX) violations are automatically elevated to Critical, and hardcoded secrets are always Critical. - Two-phase workflow: A findings phase that can run in a fresh reviewer-agent context in parallel with code and quality reviews, followed by an interactive resolution phase where findings are fixed, deferred, or accepted as documented risks. - Use Case: After a ticket touching user input or authentication is delivered, run the review to produce a report at .gener8v/changes/<change-slug>/reviews/, then resolve each finding with the user and record approved remediations in the delivery record. ## Quick Start Run a security review on the delivered ticket by saying: security review TICKET-007 in the current change.
