code-review-security

# Vulnetix Code Review (Security) Skill ## Use when - Pre-merge: comprehensive security gate on the PR diff. - Post all the right checks (SAST + SCA + secrets + container + IaC + license) without invoking each one separately. - Producing a unified PR review comment via `gh pr review`. - CI gate: block merge if any subsystem reports critical/high findings. - Pre-release: final security pass on the release branch. ## Don't use for - Single-subsystem scan — use the specific skill (`/vulnetix:sast-scan`, etc.). - Triage of existing memory state — use `/vulnetix:dashboard`. - Multi-step orchestration with conflict resolution — use `@pr-security-reviewer` agent. ## Conventions This skill follows [`_lib/contract.md`](../_lib/contract.md): the Vulnetix CLI is auto-installed by hooks, `.vulnetix/capabilities.yaml` is always present, every `vulnetix vdb` call is piped through a verified `jq` filter from [`_lib/jq/`](../_lib/jq/), independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns. A complete pre-merge security gate. Composes SAST + SCA + secrets + container + IaC + license, scoped to the diff. ## Step 1: Load capabilities Read `.vulnetix/capabilities.yaml`. Use `repo.*` flags to skip scanners that have nothing to scan (e.g. skip IaC if no `*.tf` present). ## Step 2: Decide diff scope If `--pr <number>` and `binaries.gh: true`: ```bash gh pr dif...