security-reviewlisted

# OWASP-Based Code Security Audit Target: $ARGUMENTS (domain name, file path, or "all") ## Default Flow Position - Step: **`self-review`** (security-sensitive surfaces: auth, tokens, sensitive fields, file upload, credentials) - Routes after: completion gate (`/sync-guidelines` if drift; otherwise `/review-pr`) - Recursion guard: do not invoke `/security-review` recursively, do not invoke `/plan-feature` from inside ## Procedure Overview 1. Resolve the audit scope and run the feature-detection / reference-freshness preflight (Phase 0) 2. Audit the target against the 13 security checklist categories (Phase 1) 3. Determine stale-reference drift, other `Drift Candidates`, and whether `Sync Required` is `true` or `false` (Phase 2) 4. Report using the protocol output contract — `Findings` (open) + `Coverage` (OK/SKIP) + `Verdict: N/A (audit-only scope)` (Phase 3) Read `docs/ai/shared/skills/security-review.md` for detailed steps, and [`docs/ai/shared/review-protocol.md`](../../../docs/ai/shared/review-protocol.md) for the shared output contract (this skill applies the `SEC` dimension in depth). Also refer to `docs/ai/shared/security-checklist.md` for the full checklist. For cross-tool review prompts, use the shared procedure's `Cross-Tool Review Prompt Template` section; do not duplicate the template here.