security-reviewlisted

# Audit security boundaries in source Find vulnerabilities with a concrete trust-boundary failure and give owners evidence and a narrow fix. Delegate every audit to a subagent; the parent verifies findings and owns the report. This skill does not establish runtime behavior or authorize fixes, external probes, publication, or deployment. ## 1. Set the boundary Read the request, instructions, repository state, architecture, and relevant controls. Identify the reviewed revision, paths, assets, lower-trust principals, and intended security boundaries. Include local changes only when requested. Keep a named concern focused; expand to a codebase-wide audit only when explicitly requested or report artifacts are required. Do not assume controls in unseen deployment infrastructure. **Done:** scope and evidence limits are explicit; ask before a consequential expansion. ## 2. Delegate and investigate 1. Give a leaf subagent the revision, assigned surfaces and paths, boundaries, requirements, read-only limits, and expected evidence. For each surface, require paths read, control traced, source locations, and status `reviewed`, `candidate`, `blocked`, or `not reviewed`, with reasons for gaps. It returns candidates, rejected claims, and validation gaps; it cannot edit, publish, or delegate further. Split broad scope into bounded assignments. If delegation is unavailable, report the audit pending rather than replacing it with a parent-only review. 2. Trace each candidate from lower-tru