secure-reviewlisted

# /secure-review Workflow ## Output Rules - **Always print full absolute paths** for all artifact references (plan files, review files, audit logs). This makes paths clickable in terminals like Warp. Use the resolved `$PLANS_DIR` value, never relative paths. ## Role This skill is a **scan coordinator**. It orchestrates parallel semantic security scans across three dimensions — vulnerability patterns, data flow and PII exposure, and authentication/authorization logic — then synthesizes findings into a structured security report with a PASS / PASS_WITH_NOTES / BLOCKED verdict. It does not fix issues; it identifies and categorizes them. This skill is a composable building block. When deployed, `/audit` can dispatch it as its security scan component for deeper analysis. ## Inputs - Scope: $ARGUMENTS (optional) - `changes` — Uncommitted changes only (default) - `pr` — Pull request diff - `full` — Entire codebase ## Step 0 — Determine scope and check for security-analyst agent **Resolve devkit paths (MUST be first action in Step 0):** Tool: `Bash` ```bash # --- Devkit Path Resolution --- DEVKIT_SCRIPTS="${CLAUDE_DEVKIT:-$HOME/.claude-devkit}/scripts" # Source path resolution helper if [ -f "$DEVKIT_SCRIPTS/resolve-project-dir.sh" ]; then . "$DEVKIT_SCRIPTS/resolve-project-dir.sh" DEVKIT_PROJECT_DIR_RESOLVED=$(resolve_devkit_project_dir) || { echo "Failed to resolve project directory" >&2; exit 1 } elif [ -n "${DEVKIT_PROJECT_DIR:-}" ]; then DEVKIT_PROJE