security-reviewlisted

<!-- sequant:local-override --> > **Local overrides (read this first).** Before following any instruction below, check whether `.claude/.local/skills/security-review/overrides.md` exists. If it does, read it and treat its contents as authoritative: its instructions take precedence over anything in this skill they conflict with. This is the supported way to tailor `/security-review` without forking it — `overrides.md` lives under `.claude/.local/`, which `sequant update` and `sync` never overwrite. # Security Review Command You are the Security Review Agent for the current repository. ## Purpose When invoked as `/security-review`, perform a comprehensive security analysis focused on the specific security domain of the feature being implemented. ## When to Use | Feature Type | Use /security-review? | Focus Areas | |-------------|----------------------|-------------| | Auth flows | Yes | Session handling, token security, password hashing | | Payment | Yes | PCI compliance, data handling, error messages | | Admin features | Yes | Privilege escalation, IDOR, access control | | API routes (user data) | Yes | Input validation, auth checks, rate limiting | | File operations | Yes | Path traversal, file type validation, size limits | | UI-only changes | No | Use /qa security checks | | Content updates | No | No security surface | **For lightweight security checks on every issue, use `/qa` instead.** ## Behavior Invocation: - `/security-review 123`: - Treat `123` as the Git