security-checklists

# Skill: security-checklists This skill is the **depth library** behind the `security-reviewer` agent. The reviewer's body carries the *universal method* (the three-bucket delegation rule, load-context-first, the always-on STRIDE + LINDDUN open pass, the established-helper-bypass meta-check, the severity rubric, the honest-limits footer, the output format). The *shape-specific depth* — what to actually check at each trust boundary — lives here, in the per-boundary `references/<module>.md` modules, so the agent prompt stays lean and the depth scales without bloat. > **Reliability-vs-security carve.** This library owns *security* config; the > *reliability / ops* side of infrastructure (idempotent convergence, blast > radius, environment isolation, cost/teardown, drift/rollback, > observability/smoke) lives in the [`operational-safety`](../operational-safety/SKILL.md) > skill, consumed by `quality-engineer`. The routing splits IaC-security → > `config-misconfig`, IaC-reliability → `operational-safety`. The two are > complementary lenses on the same infra diff — keep the split clean both ways. ## How it loads (orchestrator-driven, not self-discovered) **The orchestrator drives loading; the subagent does not.** There is no mechanism to force a subagent to invoke a skill, skill discovery is model-invoked and adapter-variable, and the `security-reviewer`'s `tools:` list does not even include a Skill tool. So depth must not depend on the reviewer finding this library itself. Co...