Results for “security-review”

Security-focused code review identifying high-confidence exploitable vulnerabilities with two-axis severity/confidence scoring, OWASP 2025 alignment, per-finding Haiku verification, and false positive filtering. Optional GitHub PR posting. Use when user runs /security-review, /review:security-review, requests a "security review", "security audit", "vulnerability scan", or mentions "find vulnerabilities", "check for exploits".

The English summary is being prepared. Showing the original description.

5つの専門エージェント（backend-reviewer, frontend-reviewer, test-reviewer, security-reviewer, ux-reviewer）がチームでコードレビューするスキル。 git diff ベースで変更ファイルを検出し、各専門家が並列でレビューして 統合レポート（Markdown）を docs/reviews/ に出力する。 Use when: コードレビューしたい、変更をレビュー、レビューチーム、 チームレビュー、実装をチェック、品質チェック。 Triggers: "レビュー", "review", "コードレビュー", "code review", "チームレビュー", "team review", "変更をチェック", "品質チェック"

The English summary is being prepared. Showing the original description.

Use when legacy prompts or older framework flows reference `security-reviewer` and you need the modern runtime to resolve that capability cleanly.

The English summary is being prepared. Showing the original description.

Use when performing security audits, vulnerability assessments, penetration testing, or when asked to find security issues. Use when encountering code that handles user input, executes commands, reads files, or makes network requests.

The English summary is being prepared. Showing the original description.

コード品質の最終確認。Skill: code-review (built-in) で correctness bug を検出 → main agent が findings を修正 → lint/ty 静的解析 → 条件付きで security-reviewer / critic を spawn (security 関連変更 or plan/requirements.md がある時のみ)。「品質チェックして」「品質ゲート通して」「レビューして」「コードを確認して」「PR 出す前にチェック」「セキュリティ大丈夫？」「コード見て」で発動。

The English summary is being prepared. Showing the original description.

Performing security reviews of serverless functions across AWS Lambda, Azure Functions, and GCP Cloud Functions to identify overly permissive execution roles, insecure environment variables, injection vulnerabilities, and missing runtime protections.

The English summary is being prepared. Showing the original description.

社員が申請したソフトウェア・SaaS・クラウドサービスの社内利用可否を、企業のIT/セキュリティ統制の観点から調査・評価するスキル。「〇〇のセキュリティ評価をして」「〇〇は社内で使っても大丈夫？」「このSaaSのセキュリティチェックをして」「新しいツールの導入審査をして」「〇〇と△△どちらが安全？」のような依頼で必ず使うこと。「セキュリティ」という言葉がなくても、特定のツール・サービスの社内導入可否・利用申請・リスク判断が話題になったら使う。Web検索で一次情報（プライバシーポリシー、利用規約、セキュリティホワイトペーパー、第三者認証）を収集し、6分野18項目のチェックリストに基づく3段階リスク評価付きの日本語レポート（Markdownファイル）と、ワークフロー（稟議）システムの承認コメント欄に貼れる短文サマリーを生成する。

The English summary is being prepared. Showing the original description.

Uncorrelated Evaluator — 4軸ルーブリック専門エージェント（functionality-reviewer・code-reviewer・design-reviewer・originality-reviewer）と security-reviewer を5並列実行し、成果物を多面的に独立評価します。PASS / NEEDS WORK / BLOCKED 判定を返します。Self-leniency 防止のため、実装エージェントのコンテキストを引き継がない新規エージェントとして起動します。「レビューして」「評価して」「実装を確認して」などのリクエストで起動します。

The English summary is being prepared. Showing the original description.

Review authentication, payments, and APIs for security risks using implementation examples and a predeployment checklist. Covers input validation, access permissions, secret storage, request limits, and checks for sensitive information in logs and errors.

• Reviewing login and access permissions
• Checking API input and file uploads
• Reviewing secrets and sensitive logs

Turn a design or requirements document into a working MVP, a minimal product, through small end-to-end feature slices. It coordinates scaffolding, repeated generation and evaluation, reviews, and approval gates, with separate commits for the scaffold and each slice.

• Building a working MVP from a design document
• Planning small end-to-end feature slices
• Scaffolding the first working feature

Change an existing feature that works but needs different behavior. The skill updates tests to reflect the new requirements, adjusts the implementation, and coordinates review with approval checkpoints before committing the changes.

• Changing an existing alert threshold
• Adjusting a working feature to new requirements
• Updating tests before changing behavior

Coordinate a new feature from research and planning through tests, implementation, review, and commit. Assign phases to matching ECC agents, write failing tests before implementation, and pause for approval of the plan and before committing.

• Adding a capability that does not exist yet
• Implementing a feature with tests written first
• Reviewing an authentication feature for security

Plan an AI team around a goal, defining roles, deliverables, and a recorded unit budget. After approval, it creates team, run, and task records in RuFlo AI Team; it does not execute the work.

• Plan roles for a new AI team
• Split a large goal into tasks with clear owners
• Organize a research, release, or security review team

Review source code with Strix to trace data flow and authorization checks, then test suspected vulnerabilities in a running environment. Receive proven findings with exploit examples and code locations, while keeping unconfirmed observations clearly identified.

• Reviewing a repository for security vulnerabilities
• Checking authorization logic in a specific service
• Reviewing security risks introduced by a branch

Review pending code changes for newly introduced security vulnerabilities with clear exploitation paths. Focus on concrete, significant risks and filter likely false alarms, then report affected files, line numbers, severity, attack scenarios, and recommended fixes in Markdown.

• Review a PR for newly introduced security vulnerabilities
• Check authentication and authorization changes
• Trace user input for injection risks

Review concrete code for exploitable security defects, including missing access checks, unsafe input handling, and exposed secrets. Report verified issues with file locations, reachable attack paths, severity, and suggested fixes.

• Review a code change for exploitable vulnerabilities
• Check authentication and access controls
• Trace unsafe input handling and secret exposure

Review source code for MCP, a protocol connecting AI applications to tools. Check authentication, input validation, unsafe execution, and other security risks, then report findings with file and line references and separate manual follow-ups.

• Reviewing an MCP server before release
• Checking authentication and validation on a network-exposed server
• Auditing tool code for unsafe execution paths

Configure tools and skills for sub-agents before dispatching development tasks. Role presets cover implementation, planning, reviews, testing, and verification, with defined boundaries for what each agent should do and whether it may modify files.

• Setting tool permissions before spawning a sub-agent
• Separating implementation, planning, and review roles
• Configuring agents for review without file changes

Review code for security vulnerabilities using a checklist covering unsafe input, authentication, access permissions, secrets, and data exposure. Classify findings into four severity levels to distinguish exploitable flaws, issues needing investigation, and smaller improvements.

• Review SQL, shell commands, and HTML for unsafe input
• Check authentication and access permissions
• Find exposed credentials and sensitive log data

Review code changes for newly introduced security issues with a plausible attack path. Produce findings for the Warden security summary, including affected lines, severity, a minimal fix, and observable conditions for confirming the issue is resolved.

• Checking a PR for newly introduced vulnerabilities
• Reviewing CI changes that expose secrets or write access
• Inspecting Electron changes for unsafe permissions

Review code and infrastructure for vulnerabilities, insecure dependencies, and exposed credentials. Combine automated scans with manual review to produce audit reports that identify affected locations, rate severity, and prioritize practical fixes.

• Reviewing code for security vulnerabilities
• Checking dependencies and exposed credentials
• Auditing cloud and infrastructure security

Review code changes and files for bugs, security risks, performance problems, design issues, and test coverage. Receive a structured report with prioritized findings, concrete improvement examples, positive feedback, and an overall review verdict.

• Reviewing a pull request
• Auditing code quality and security
• Finding refactoring opportunities

Audit PHP and other source code by listing calls to known dangerous functions, checking for enumeration gaps, and examining input paths and safeguards. Store risk assessments and verdicts in a searchable audit ledger.

• Security reviews of PHP apps and WordPress plugins
• Checking for missed calls to known dangerous functions
• Tracing external input to risky operations

Review authentication, payments, API endpoints, and sensitive data handling for security weaknesses. Checklists and code examples cover input validation, secret storage, access permissions, common web attacks, dependency checks, and security tests before deployment.

• Review authentication and access permissions
• Check input validation for forms and file uploads
• Inspect secret handling and payment logs