security-review git:20260717.dc9a72dA

Immutable. This exact content is served forever at /api/v1/blob/587b1e9e4a03a38e.

---
name: security-review
description: Perform a focused security review of changed code and configuration. Use when work touches authentication, authorization, secrets, command execution, file paths, archives, network calls, redirects, user input, databases, dependencies, plugins, MCP tools, logs, permissions, sandboxes, or agent boundaries.
---

# Security Review

Review the security-sensitive surface changed by the current task.

## Workflow

1. Identify touched trust boundaries, untrusted inputs, and dangerous sinks.
2. Trace external input through parsing, validation, authorization, and side effects.
3. Check for committed or exposed credentials and sensitive log data.
4. Check command construction, quoting, argument boundaries, and injection paths.
5. Check file paths, archives, uploads, and downloads for traversal, unintended overwrite, unsafe deletion, and resource exhaustion.
6. Check network behavior for SSRF, open redirects, insecure transport, credential leakage, and unbounded requests.
7. Check authentication and authorization for missing enforcement, privilege escalation, tenant leakage, and insecure defaults.
8. Check dependency and tool changes for unexpected sources, unsafe permissions, and inappropriate version pinning.
9. Check plugin, MCP, sandbox, and agent configuration for hardcoded secrets, broad access, and hidden side effects.
10. Fix confirmed issues within scope and report unrelated risks separately.

## Finding Standard

For each confirmed finding, identify:

- affected location and behavior;
- exploit or failure path;
- severity and impact;
- smallest safe fix;
- verification performed.

Do not report speculative concerns as confirmed vulnerabilities, rotate credentials, modify live services, add security frameworks, or broaden the task into a general security rewrite without authorization.