What problem does it solve? Security reviews often produce vague best-practice advice without concrete evidence, making it hard to distinguish real vulnerabilities from noise. This Skill enforces a disciplined review process where every finding cites affected files, functions, and evidence, with clearly labeled confidence levels. ## Core Features & Use Cases - Evidence-Backed Findings: Every issue includes severity, affected files/functions, risk description, evidence, impact, and a recommended fix. - Scope and Permission Control: A contract file defines read/write scope, allowed actions, and forbidden behaviors such as modifying files or accessing secrets. - Uncertainty Labeling: Confirmed risks are distinguished from hypotheses, and incomplete evidence is preserved rather than hidden. - Use Case: Point the agent at a repository's authentication module and receive a structured report of confirmed injection risks with verification suggestions and regression test recommendations. ## Quick Start Ask the agent to perform a secure code review of the packages directory and report evidence-backed findings with severity and remediation steps.
