Security Review

This is a structured security auditing skill that walks Claude through threat modeling, vulnerability scanning, and remediation planning for both code and AI prompts. It enforces hard rules like not dismissing findings without proof and not exposing discovered secrets, then runs through a checklist covering OWASP risks, prompt injection, and business logic flaws. The workflow is opinionated about severity classification and includes a table of developer rationalizations to push back against. What's useful here is the dual focus on traditional app security and LLM-specific attacks, treating prompts as code that controls tool execution. Good for pre-commit reviews or release audits when you want consistent coverage without the false negatives that come from ad-hoc security questions.