el-red-reviewlisted
Install: claude install-skill threatroute66/EL
# el-red-review — Claude Code fulfilment of the EL adversarial challenger
EL's adversarial Red Reviewer composes two challengers:
1. **Rule-based challenger** — ALWAYS runs, deterministic. Sets each
finding's `red_review.status` during the run so the pipeline never
blocks.
2. **LLM challenger** — runs in-process when `ANTHROPIC_API_KEY` is set.
When the key is absent but EL is inside a Claude Code session (or the
operator set `EL_RED_REVIEW_DEFER=1`), EL writes a request file at
`reports/_red_review_request.json` instead of skipping the LLM.
**You are that LLM challenger, via this skill.**
The challenger's job is to **falsify** findings, not validate them. A
stricter LLM verdict can lift a finding from `passed` to `challenged`;
it never fake-passes. The merge is severity-max
(`challenged > unresolved > passed`).
## When to fire
- The user explicitly invokes `/el-red-review` (with or without a case-id).
- A new `_red_review_request.json` appears under any
`/opt/EL/cases/<id>/reports/` (e.g. after an `el investigate` run
inside Claude Code with no API key).
If the user hasn't asked and there are no pending requests on disk, do
nothing — this skill is a worker, not a watchdog.
## Procedure
1. **Discover pending requests**.
```bash
find /opt/EL/cases -maxdepth 3 -name "_red_review_request.json" -type f
```
If the user passed a case-id, scope to that case. If nothing matches,
say "no pending red-review requests" and stop.
2. **Read the