security-reviewlisted

Use when an implementation slice's changed surface needs its security review: reviewing the actual changed files for auth, tenant-isolation, permission, and secret-handling correctness, producing applicable security-standard evidence and a residual-risk statement. This is the security_review action of the implementation stretch — one Agent-tool dispatch with subagent_type security-reviewer — implementation-level review of real changes, distinct from security-architecture-review (design-level) and the security_pattern_review action (review-diff skill, the later diff-pattern pass in code review).
BhangeeF16/kaizen · ★ 0 · Code & Development · score 65

Install: claude install-skill BhangeeF16/kaizen

# Security Review (Implementation) Review what actually changed, as changed — not the design's intent. A passing backend or frontend implementation does not substitute for this action's own evidence. ## Dispatch One synchronous `Agent`-tool call, `subagent_type: security-reviewer`. ## Required inputs - The changed files or documentation of the slice. ## Required outputs (all mandatory) - Applicable security evidence for the changed surface (application-security standards, supply-chain/SBOM evidence where dependencies changed). - A security residual-risk statement — explicit, even when the list is empty. ## Result Report each required output produced (with its location), the result (pass / pass_with_risks / blocked / failure), and blocking questions as an explicit list (empty list stated explicitly).