What problem does it solve? Manual security review of pull requests and infrastructure changes is slow and inconsistent, and generic code review misses cross-file trust-boundary issues like broken authorization, weak cryptography, and overly permissive IAM policies. ## Core Features & Use Cases - Semantic security review: Analyzes authentication flows, business-logic authorization, cryptographic primitive selection, secret handling, and IAM policy reasoning across C#/.NET, Python, TypeScript/JavaScript, T-SQL, Azure, AWS, and Active Directory/LDAP. - First-party documentation grounding: Cites vendor documentation (Microsoft Learn, AWS docs, OWASP, CWE) with visible review dates, and surfaces conflicts between first-party sources instead of guessing. - Structured findings output: Emits severity-classified findings (Critical/Error/Warning/Info) with file:line references and a PASS/PASS_WITH_WARNINGS/NEEDS_CHANGES/PRECONDITION_FAILURE verdict. - Use Case: A PR adds JWT validation to an ASP.NET Core API and a new IAM role for an AWS Lambda. The skill verifies the JWT algorithm allowlist against Microsoft documentation, checks the IAM trust policy for missing ExternalId conditions, and reports both with severity and citations. ## Quick Start Ask the security-review-expert subagent to review the changes in your current branch for authentication, authorization, cryptography, and IAM issues, providing the path to the code under review.
