security-review

# security-review ## Overview An optional, user-invoked security gate over the code a vibe run produced. The skill: 1. Reads the diff from the isolation base to `HEAD` on the vibe branch. 2. Skips fast when the diff has no security surface (docs/tests only). 3. Classifies the changed artifact to decide which threat tiers apply. 4. Walks the active threat categories as a checklist, each finding backed by verbatim `file:line` evidence. 5. Scores the findings and returns a verdict: `clear` or `blocked`. 6. When `blocked`, halts the handoff to `finish-branch` until the user fixes or waives. It is a peer to `review-pack`, not a replacement: `review-pack` critiques the work against *the spec*; `security-review` critiques it against a *threat model*. Both are optional gates offered after `verify-gate` returns `ready`; a user may run either, both, or neither before `finish-branch`. This skill never executes the code it reviews — it reasons over diff text only. ## When to invoke - After `verify-gate` returns verdict `ready`, when the user chooses the security-review option in `vibe`'s final message. - Standalone, when the user asks for a security pass on the current diff. Do not invoke: - If `verify-gate` returned `not ready`. This gate is not a bypass. - If there are no commits on the vibe branch beyond the isolation base — there is nothing to review. ## Prerequisites - A diff exists between the isolation base and `HEAD` (or the working diff, in standalone mode). - Spec and ...