Security audit
Security checks for vulnerabilities and agentic risk
This is a Markdown-only code review workflow skill with no hidden execution, persistence, credential use, or unrelated data access.
Install only if you want agents to routinely ask a review subagent to inspect code changes. Be aware that the template may encourage frequent reviews and may create a temporary git worktree if a reviewer needs another revision, but the skill does not contain executable code or hidden network/persistence behavior.
The manifest description says to use the skill when 'completing tasks, implementing major features, or before merging,' which is a very broad set of common engineering activities. It does not define clearer trigger phrases, scope constraints, or negative examples to distinguish when this skill should or should not be invoked.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Give a clear verdict
**DON'T:**
- Say "looks good" without checking
- Mark nitpicks as Critical
- Give feedback on code you didn't actually read
- Be vague ("improve error handling")
The template labels the review as 'read-only' but includes git worktree add, which does mutate the local filesystem by creating a new worktree directory and administrative git metadata. That mismatch can mislead downstream agents into performing side effects in environments expected to be non-mutating, increasing risk in constrained or sensitive workspaces.
No suspicious patterns detected.