tm-security-review

TM Security Review (comprehensive tier)

Model first, hunt second. A bare hunt enumerates source→sink flows but never asks "is this source actually lower-trust than its sink?" — so it over-rates operator-controlled inputs (CLI flags, config, a JAR on the classpath) as HIGH and misses the real design risk (e.g. an indirect-prompt-injection → auto-exec chain). The threat model supplies that missing trust-direction check. This skill builds the model, then runs the sophisticated zeroday exploit hunt against it.

This is the deep, comprehensive, whole-repo review with a threat model as input — the heavier of the two tiers. When you only need a quick pass over the changes on a branch/worktree, use tm-quick-security-assessment instead (and optionally hand its finding surface here for the deep follow-up).

It composes two sibling skills:

• Phase 0 → threat-modeling (../threat-modeling/SKILL.md) — STRIDE/DREAD, DFD, trust boundaries.
• Phases 1-3 → 0day-scanner (../0day-scanner/SKILL.md) — the LLM exploit engine, run in deep mode, steered by the model's KEY threats. Its on-disk fallback (security-reviewer/languages/* + 8-point check) applies when the MCP tool is unreachable.

When to use

• "threat model security review", "hunt for exploitable vulns with a threat model", "/security-review"
• Agentic / LLM / MCP / connector codebases; whole-repo or pre-merge exploit review
• You need a runnable PoC + evidence chain per finding, not a posture summary

Inputs (ask; if user is away, default + label [ASSUMPTION])

• Target: repo path / service / feature / diff + commit or branch.
• Existing threat model? If handed one (e.g. *-threat-model.md), ingest it as Phase 0 — do not regenerate.
• Deployment/trust context (drives severity): self-hosted library vs hosted multi-tenant service; who is the attacker vs the operator; any network-exposed surface (stdio vs HTTP)?

---

Phase 0 — Threat model (run the threat-modeling skill)

Produce, or ingest, a STRIDE-per-trust-boundary model. Beyond that skill's default output, require:

• DFD with every trust-boundary crossing labelled TBn, and a | ID | Boundary | Crosses | Primary risk | table.
• Confidence label on every threat: [CONFIRMED] / [REFUTED] / [ASSUMPTION] / [QUESTION].
• AI surfaces mapped to OWASP Top 10 for LLM Apps 2025 (LLM01 prompt injection, LLM02 sensitive-info disclosure, LLM05 improper output handling, LLM06 excessive agency, LLM08, LLM10). These design risks are the ones no pattern scanner can test.
• Severity calibrated to the deployment context from Inputs.
• Surface the [QUESTION]/[ASSUMPTION] items that change severity and ask the user; if away, take the conservative default and mark it.