review-code-security

Scan the specified code for security anti-patterns using the same three axes as /review-plan-security. Use after implementation to verify the plan's security goals hold in the actual code.

When to Use

Use when the implementation touches external input, secrets handling, or third-party integrations. Pass a file path, diff, or describe the code to review.

Rules

• Report each finding with: file/location, pattern category, and recommended fix.
• Note context for potential false positives (test fixtures, comments, examples).
• For commit-time auto-scanning of hard secrets (AWS/LLM API keys, PEM keys, GitHub/Slack tokens, .env commits), see docs/scan-outbound.md — those are covered automatically.
• Sibling sweep: enumerate functions, logic, or patterns the change touches that belong to a class; flag siblings as MUST / OPTIONAL / NA for same treatment.

Procedure

RCS-1. Open the concern round (Bash): bash "$AGENTS_CONFIG_DIR/skills/review-code-security/scripts/open-concern-round.sh" — prints ROUND, PLANS_DIR, SESSION_ID, and the [PRIOR CONCERNS START]…[PRIOR CONCERNS END] block both producers receive. ROUND=0 means the ledger is unavailable: run RCS-2 and RCS-3, report the NOT-STAGED line, skip the ledger close-out in ## Completion.

RCS-2. Delegate scan to security-scanner, issued together with the RCS-3 quality gates per skills/_shared/subagent-concurrency.md SC-P (independent — both are read-only over the merge-base diff and write no shared target):

Agent({ subagent_type: "security-scanner", prompt: JSON.stringify({
  topic: "security review", context: SCAN_TARGET,
  artifact_dir: PLANS_DIR, prior_concerns: PRIOR_BLOCK
}) })

Pass the RCS-1 block verbatim as prior_concerns; omit the key when RCS-1 printed none. On failed status: surface summary + artifact_path to user. Output: ## Security Review: PERFORMED|FAILED (1 line) + artifact_path pointer. Read report only on failure or explicit user request.