W Security

Reviews code changes or a repository tree for security defects against existing security docs and scanners.

What it does

This skill guides a report-only security review of a change set or repository tree, anchored to the repository's own security documentation and existing scanners. It reads those docs first, then dispatches two to three read-only explorers over authentication/authorization, secret exposure, and input validation for the changed paths, and reconciles trigger and consequence for each suspected issue. It can run existing security scripts or CI jobs when authorized and records whether they passed, failed, or were not run, and it may apply fixes to the owning cause when the user authorizes them.

When to use it

Use it when a code change or repository tree needs a security review grounded in the project's documented security bar and existing checks. It fits pre-merge review, audit-style passes, and hardening work where findings should be reported rather than invented. It is not meant for teams without repository security docs, since it stops and asks instead of setting its own standard.

Requirements

Requires repository security documentation to exist, plus access to the changed paths and, when running checks, the project's security scripts or CI jobs (for example via package.json). It ships no scripts of its own and is instructions only. It may spawn read-only explorer subagents and, if fixes are authorized, edit code; policy changes are deferred to a human.