security-code-review

Invoke the skill with the PR number as the argument, for example /security-code-review 42. It resolves the changed files with gh pr diff, reviews only those files, and records any findings with severity and line numbers.

Run the skill with no arguments, which sets the scope to the full codebase. The review covers the repository under src/ and tests/ and marks the run as a full scan when finalizing.

It detects concrete bugs such as logic errors and race conditions, vulnerabilities like injection, unsafe deserialization, missing authentication or authorization checks, and secrets in code, plus likely-issue patterns such as missing input validation.

Yes, pass a branch name or commit range such as main..HEAD as the argument. The skill uses git diff to resolve the changed file list and reviews exactly those files rather than the whole repository.

A zero-findings result is treated as a valid outcome, not a failure. The run is still finalized and the report explicitly states that no findings were recorded for that capability.

A PR-scoped run only examines the changed files, so it cannot auto-resolve findings in files it never inspected. Only a full-codebase run is finalized with the full flag that allows resolving older findings.