edc-reviewlisted

Performs security/adversarial differential review of code changes (PRs, commits, diffs). Use this for auth, validation, trust-boundary, injection, crypto, memory-safety, external-call, state-mutation, or security-regression risk. It leverages git history and edc-context for blast radius and writes markdown security reports.
almogdepaz/EDC · ★ 1 · Code & Development · score 70

Install: claude install-skill almogdepaz/EDC

# Security Review Review code changes for exploitable or misuse-oriented security risk. This is not a generic code-quality or delivery/spec review. Use edc-audit for code quality, maintainability, bloat, duplication, and test-value analysis. Use edc-delivery-review for goal/spec delivery and architecture-fit review. Use this skill when the important question is: **can this change break a trust boundary, remove a protection, expose attacker-controlled input, or reintroduce a security bug?** ## Invocation modes Check arguments first. ### Mode A — scoped (`--task-file <path>`) The `edc-review.sh` orchestrator invokes this mode for per-module security reviews. 1. Read the task file at `<path>`. 2. Parse: - **Target** under `## Target` - **Baseline** under `## Baseline` when present - **Files to review** under `## Files to review` 3. Derive `{module}` from the task file basename. 4. Load context in this order, skipping missing files silently: - `edc-context/index.md` for routing/coupling/blast-radius guidance - `edc-context/reports/issues.md` - `edc-context/modules/{module}.md` 5. Scope review strictly to listed files. Inspect callers/dependencies only when security blast radius or reachability requires it. 6. Follow `methodology.md`, `adversarial.md`, `patterns.md`, and `reporting.md`. 7. Write `edc-context/review-tasks/report-{module}.md`. The report file is mandatory. Do not write elsewhere, update `manifest.json`, or consolidate. The orchestrator hand