What problem does it solve? Manual security review of code diffs is inconsistent: reviewers miss injection paths, broken object-level authorization, insecure deserialization, and LLM-specific risks because no single checklist covers every application type. This Skill provides question-driven walkthroughs keyed to the actual security surface of a diff, so reviewers systematically check what compilers and test suites cannot catch. ## Core Features & Use Cases - Category-based review walkthroughs: Separate reference docs for web applications (OWASP Top 10), APIs (OWASP API Security Top 10), LLM-integrated features (OWASP LLM Top 10), and CLI/library/IaC code (MITRE CWE Top 25 keyed by language). - Risk-tiered depth selection: An ASVS guide helps pick L1/L2/L3 verification depth based on the sensitivity of the data flows in the diff, with spot-check questions per category. - Single-finding investigation playbook: Canonical questions for reachability, authorization coverage, data flow, trust boundaries, concurrency, and secrets lifecycle when following up on one suspicious pattern. - Use Case: Before merging a pull request that adds a new REST endpoint touching user data, walk the API checklist to verify per-object authorization, rate limiting, and mass-assignment protections, citing file:line evidence for each finding. ## Quick Start Ask the AI to review the current diff for security issues using the rafter-code-review checklist matching the type of code changed.
