domains / families / security / security-reviewer
Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists. Dedicated security-audit route for OWASP-style risks, secret leaks, auth flaws, injection, unsafe input handling, SSRF/XSS, and sensitive-data exposure. Use instead of code-reviewer when the prompt explicitly asks for security, vulnerability, threat, auth, or OWASP review.
Both copies define a security-reviewer skill, but they are not the same procedure. The Jeffallan copy is a full audit workflow with explicit tool commands (semgrep, bandit, gitleaks, npm audit, trivy), CVSS severity, written authorization and rules of engagement, a reference-guide table, and a report template. The Vibe-Skills copy is a routing-focused, OWASP-oriented checklist with a different severity scale (CRITICAL/HIGH/MEDIUM/LOW), a high-risk pattern audit, and pairing guidance with other skills. Each has material steps the other lacks, and they disagree on severity taxonomy and on whether active testing/authorization is in scope, so crowning one would hide a real alternative.