security-reviewlisted

Team baseline for security review — a best-effort heuristic security pass over a diff or change-set. Auto-triggers for review this for security, any vulnerabilities here, security pass on this diff, is this code secure, check this for security issues, or security review this. Uses installed scanners when available; installs nothing. Defers to any other installed skill whose description identifies it as handling security review, SAST, or vulnerability analysis, including `adobe-security-*`; prefer it over this slim baseline. Do not use for spec-compliance review (use `/jig:independent-review`), general PR craft (use `/jig:pr-review`), or secret prevention (`jig-secret-scan`).
ramboz/jig · ★ 4 · Code & Development · score 73

Install: claude install-skill ramboz/jig

> Spec 052 introduced this skill as jig's **team baseline** for security > review, under [ADR-0013](../../docs/decisions/adr-0013-security-floor-policy.md)'s > "jig provides the floor; bring your own depth" principle. Like > `/jig:pr-review` (spec 012), `/jig:arch-review` (spec 014), and > `/jig:contracts` (spec 022), it ships as SKILL.md only — no `.py` > helper. It is fundamentally a judgment skill; the determinism it needs > (detect a scanner on `PATH`, run it, read a diff) Codex runs inline. > If any other skill is installed whose description identifies it as > handling security review, SAST, or vulnerability analysis, the Codex > Code skill router prefers that one over jig's baseline — the deferral > is **category-based, not name-specific**, so a richer skill named > anything (`security-review`, `adobe-security-reviewer`, `sast-scan`, > `vuln-audit`, etc.) wins. Jig's slim version remains the auto-trigger > when no such skill is installed. ## What this skill does Produces a **breadth-over-depth heuristic security pass** over a diff, a branch's changes, or a pasted snippet, in a four-bucket markdown envelope: 1. **Summary** — a one-paragraph read of what changed and the overall security posture (clean / needs fixes before merge / needs a deeper look). 2. **Blockers** — concrete must-fix security issues. Each cites a `file:line` and a one-sentence rationale. 3. **Nits** — lower-urgency hardening suggestions. Same shape as blockers. 4. **Strengths** — security-p