[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M69BFTZDV68JM4CB1C9TGFD3":3,"skill-same:01M69BFTZDV68JM4CB1C9TGFD3":67},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":43,"commitSha":44,"skillDirectory":45,"forksCount":46,"repositoryHtmlUrl":47,"repositoryHomepageUrl":48,"ownerHtmlUrl":49,"ownerBlogUrl":50,"ownerDescription":51,"updatedAt":52,"install":53,"resources":66},"01M69BFTZDV68JM4CB1C9TGFD3","security-review",null,"Security assessment workflow in two modes: architectural (design) and code (implementation). Use when a security trigger is detected during planning (architectural mode) or implementation\u002Freview (code mode). Covers STRIDE, OWASP, dependency scanning, Azure compliance, and GitHub security alerts. Do not use for general code quality (use devsquad.review), for threat modeling as a standalone activity, or for compliance audits.","microsoft\u002Fdevsquad-copilot","microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","01M698VYDXZ6JW5WH3CRV650R8","Microsoft","01M69BE5EMENJJPPKFFE4AVZPN",50,"MIT","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fdevsquad-copilot\u002Fblob\u002Fmain\u002F.github\u002Fplugins\u002Fdevsquad\u002Fskills\u002Fsecurity-review\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37],"review","security","security review","design","github","threat modeling","workflow","security alerts","code quality","azure compliance","azure","assessment","code","planning","2026-11-10 10:12:30",false,"---\nname: security-review\ndescription: \"Security assessment workflow in two modes: architectural (design) and code (implementation). Use when a security trigger is detected during planning (architectural mode) or implementation\u002Freview (code mode). Covers STRIDE, OWASP, dependency scanning, Azure compliance, and GitHub security alerts. Do not use for general code quality (use devsquad.review), for threat modeling as a standalone activity, or for compliance audits.\"\n---\n\n# Security Review\n\n## Security Principles\n\n| Principle | Application |\n|-----------|-------------|\n| **CIA Triad** | Confidentiality, Integrity, Availability in every assessment |\n| **Defense in Depth** | Multiple layers; never rely on a single control |\n| **Least Privilege** | Minimum permissions for each component |\n| **Secure by Default** | Default configurations must be secure |\n| **Zero Trust** | Never trust, always verify |\n| **Shift Left** | Detect issues early in design, not in production |\n\n## Mode Detection\n\nDetermine the operating mode from the calling agent's context:\n\n**Architectural Mode** (called from `plan`):\n- Handoff from the `plan` agent after ADR creation\n- Feature involves: auth, sensitive data, external APIs, payments\n\n**Code Mode** (called from `implement` or `review`):\n- Handoff from the `implement` agent after implementation\n- Reference to specific files or diff\n\n---\n\n## Architectural Mode (Design Security)\n\n### When to Execute\n\nThis mode is **mandatory** when the feature involves:\n\n| Trigger | Description |\n|---------|-------------|\n| Authentication\u002FAuthorization | Access control, identity, permissions |\n| Sensitive data | Information requiring protection (credentials, personal data) |\n| External integrations | Communication with systems outside the trust boundary |\n| Exposed endpoints | Interfaces accessible by users or external systems |\n| Data persistence | Storage of information that crosses boundaries |\n\n### Execution Flow\n\n1. **Read design artifacts**:\n   - `plan.md` - Stack and architecture\n   - `docs\u002Farchitecture\u002Fdecisions\u002F*.md` - ADRs\n   - `spec.md` - Requirements and user stories\n\n2. **Identify attack surface**:\n   ```\n   ## Attack Surface\n   \n   | Component | Exposure | Data | Initial Risk |\n   |-----------|----------|------|--------------|\n   | [endpoint] | [public\u002Finternal] | [data type] | [low\u002Fmedium\u002Fhigh] |\n   ```\n\n3. **Map trust boundaries**:\n   - Where does data cross trust boundaries?\n   - Which components are external vs internal?\n   - Where is authentication\u002Fauthorization applied?\n\n4. **Apply STRIDE** (simplified):\n\n   | Threat | Question | Typical Control |\n   |--------|----------|-----------------|\n   | **S**poofing | Can someone impersonate another? | Strong authentication |\n   | **T**ampering | Can data be altered? | Integrity, signatures |\n   | **R**epudiation | Can actions be denied? | Logging, audit trail |\n   | **I**nfo Disclosure | Can data leak? | Encryption, ACLs |\n   | **D**enial of Service | Can the system be taken down? | Rate limiting, quotas |\n   | **E**levation | Can privileges be escalated? | Least privilege, RBAC |\n\n5. **Evaluate ADRs**:\n   - Do technology decisions have security implications?\n   - Are there known vulnerabilities in the chosen technologies?\n   - Are default configurations secure?\n   - **For Microsoft\u002FAzure technologies**: Use `microsoft_docs_search` to check security best practices and known service vulnerabilities\n   - Use `microsoft_docs_fetch` to get the complete security hardening guide when a relevant gap is identified\n\n6. **Validate Azure compliance**:\n   - Use the `azure\u002Fpolicy` tool to verify whether the proposed infrastructure complies with the organization's policies\n   - Use the `azure\u002Frole` tool to verify whether the access model follows least privilege (RBAC)\n   - Use the `azure\u002Fwellarchitectedframework` tool for each Azure service in the architecture to get the security pillar guidance\n   - Include found violations as findings in the security report\n   - If policies block services proposed in the ADRs, record as a **High** finding\n\n7. **Generate report**:\n\n   ```markdown\n   # Security Review - [Feature]\n   \n   **Mode**: Architectural\n   **Date**: [date]\n   **Reviewer**: Copilot Security Agent\n   \n   ## Executive Summary\n   \n   **Verdict**: [APPROVED | APPROVED_WITH_CONTROLS | BLOCKED]\n   \n   [Summary in 2-3 sentences of the overall risk and main concerns]\n   \n   ## Attack Surface\n   \n   [Components table]\n   \n   ## STRIDE Analysis\n   \n   ### Findings\n   \n   | ID | Threat | Component | Severity | Status |\n   |----|--------|-----------|----------|--------|\n   | SEC-001 | [type] | [where] | [Critical\u002FHigh\u002FMedium\u002FLow] | OPEN |\n   \n   ### SEC-001: [Title]\n   \n   **Severity**: [Critical\u002FHigh\u002FMedium\u002FLow]\n   **Component**: [where]\n   **Description**: [what can happen]\n   **Impact**: [consequences]\n   **Recommendation**: [how to mitigate]\n   \n   ## Security Requirements\n   \n   Before proceeding to implementation:\n   \n   - [ ] [Requirement 1]\n   - [ ] [Requirement 2]\n   \n   ## ADR Decisions with Security Implications\n   \n   | ADR | Decision | Implication | Recommendation |\n   |-----|----------|-------------|----------------|\n   | [number] | [decision] | [risk] | [mitigation] |\n   ```\n\n8. **Save report**: Path: `docs\u002Ffeatures\u002F[feature]\u002Fsecurity-review-architecture.md`\n\n   Present the Reasoning Log in the format of the `reasoning` skill (use \"Discarded threats\" instead of \"Assumptions\" when applicable).\n\n9. **Return verdict**:\n\n   **If APPROVED**:\n   ```\n   Security Review: APPROVED\n   No blockers identified. Security requirements documented.\n   Proceed to task creation.\n   ```\n\n   **If APPROVED_WITH_CONTROLS**:\n   ```\n   Security Review: APPROVED WITH CONTROLS\n   Findings that need to be addressed during implementation:\n   - SEC-001: [title] (High)\n   - SEC-002: [title] (Medium)\n   Security requirements added to the spec.\n   Proceed to task creation with attention to controls.\n   ```\n\n   **If BLOCKED**:\n   ```\n   Security Review: BLOCKED\n   Critical issues preventing progress:\n   - SEC-001: [title] (Critical)\n   Action required: Review design before creating tasks.\n   ```\n\n---\n\n## Code Mode (Implementation Security)\n\n### Execution Flow\n\n1. **Identify scope**:\n   - If called from `implement`: review modified files\n   - If called from `review`: review files in review scope\n   - If explicit mention: review specified files\u002FPR\n\n2. **Read relevant files**:\n   - Modified source code\n   - Security tests (if they exist)\n   - Configurations (env, secrets, configs)\n\n3. **Check vulnerability categories**:\n\n   | Category | What to check |\n   |----------|---------------|\n   | **Access Control** | Authorization, privilege escalation, unauthorized access |\n   | **Data Protection** | Exposed sensitive data, inadequate encryption |\n   | **Injection** | Unsanitized input used in commands or queries |\n   | **Insecure Design** | Missing validation, violated trust boundaries |\n   | **Configuration** | Insecure defaults, debug in production |\n   | **Vulnerable Components** | Dependencies with known vulnerabilities |\n   | **Authentication** | Weak identity and session controls |\n   | **Integrity** | Data or code can be manipulated |\n   | **Logging** | Insufficient auditing or sensitive data in logs |\n   | **External Requests** | URLs or resources controlled by external input |\n\n4. **Code checks**:\n\n   Detect the project stack and apply relevant checks for:\n   - Dynamic code execution\n   - Command or data injection\n   - Deserialization of untrusted data\n   - File path manipulation\n   - Cross-site scripting\n   - Race conditions\n   - Denial of service\n\n5. **Check secrets**:\n   - Search for hardcoded credentials in the code\n   - Verify that environment files are in `.gitignore`\n   - Verify that secrets are not exposed in configuration\n   - Query `github\u002Flist_secret_scanning_alerts` for active alerts:\n     If there are open alerts, include them as Critical findings.\n\n6. **Check .gitignore**:\n   - Environment files should be ignored\n   - Local configuration files should be ignored\n   - Build\u002Fdependency directories should be ignored\n\n7. **Check dependencies**:\n   Use the appropriate audit tool for the project stack.\n   Supplement with GitHub data:\n   - `github\u002Flist_dependabot_alerts` for known vulnerabilities\n   - `github\u002Flist_code_scanning_alerts` for CodeQL alerts\n   - `github\u002Flist_repository_security_advisories` for advisories\n   - `github\u002Fget_global_security_advisory` for specific CVE details\n\n8. **Generate report**:\n\n   ```markdown\n   # Security Review - [Feature\u002FPR]\n   \n   **Mode**: Code\n   **Date**: [date]\n   **Scope**: [files\u002FPR]\n   **Reviewer**: Copilot Security Agent\n   \n   ## Executive Summary\n   \n   **Verdict**: [PASSED | PASSED_WITH_FINDINGS | FAILED]\n   \n   | Severity | Count |\n   |----------|-------|\n   | Critical | 0 |\n   | High | 1 |\n   | Medium | 2 |\n   | Low | 1 |\n   \n   ## Findings\n   \n   ### SEC-C001: [Title]\n   \n   **Severity**: High\n   **File**: `src\u002Fauth\u002Flogin.ts:42`\n   **Category**: A03 Injection\n   \n   **Vulnerable code**:\n   [code snippet]\n   \n   **Problem**: [description]\n   \n   **Remediation**:\n   [fix snippet]\n   \n   ## Security Checklist\n   \n   - [x] No hardcoded secrets\n   - [x] Input validation present\n   - [ ] Authorization verified on endpoints\n   \n   ## Dependencies\n   \n   | Package | Version | CVEs | Severity |\n   |---------|---------|------|----------|\n   | [pkg] | [ver] | [CVE-xxx] | High |\n   ```\n\n9. **Save report**: Path: `docs\u002Ffeatures\u002F[feature]\u002Fsecurity-review-code.md`\n\n10. **Return verdict**:\n\n    **If PASSED**:\n    ```\n    Code Security Review: PASSED\n    No vulnerabilities identified. Can proceed with PR.\n    ```\n\n    **If PASSED_WITH_FINDINGS**:\n    ```\n    Code Security Review: PASSED WITH FINDINGS\n    Low\u002Fmedium severity findings (non-blocking):\n    - SEC-C002: [title] (Medium)\n    Recommend fixing, but can proceed with PR.\n    ```\n\n    **If FAILED**:\n    ```\n    Code Security Review: FAILED\n    Critical\u002Fhigh vulnerabilities found:\n    - SEC-C001: [title] (High) - [file:line]\n    Mandatory fix before PR.\n    ```\n\n---\n\n## Severity\n\n| Level | Criteria | Action |\n|-------|----------|--------|\n| **Critical** | Trivial exploitation, maximum impact (RCE, massive data breach) | Blocks. Fix immediately. |\n| **High** | Exploitation possible, significant impact (auth bypass, injection) | Blocks. Fix before merge. |\n| **Medium** | Exploitation requires conditions, moderate impact | Non-blocking. Fix soon. |\n| **Low** | Difficult exploitation, limited impact | Non-blocking. Backlog. |\n| **Info** | Best practices, hardening | Informational. |\n\n## Recognized Best Practices\n\nAcknowledge when the code follows best practices:\n\n```\nBest practices identified:\n- Parameterized queries used consistently\n- Input validation with defined schema\n- Secrets loaded from environment variables\n- Rate limiting implemented on public endpoints\n```\n\n## Common Rationalizations\n\n| Rationalization | Reality |\n|---|---|\n| \"This is an internal tool, security does not matter\" | Internal tools get compromised. Attackers target the weakest link in the chain. |\n| \"We will add security later\" | Retrofitting security is 10x harder than building it in. Add controls now. |\n| \"The framework handles security\" | Frameworks provide tools, not guarantees. You still need to use them correctly. |\n| \"No one would try to exploit this\" | Automated scanners will find it. Security by obscurity is not security. |\n| \"It is just a prototype\" | Prototypes become production. Security habits from day one prevent emergency retrofits. |\n\n## Red Flags\n\n- User input passed directly to database queries, shell commands, or HTML rendering\n- Secrets in source code or commit history\n- API endpoints without authentication or authorization checks\n- Missing CORS configuration or wildcard origins\n- No rate limiting on authentication endpoints\n- Stack traces or internal error details exposed to users\n- Dependencies with known critical vulnerabilities not addressed\n\n## Constraints\n\n- **Does NOT implement code**: Provides guidance and remediation\n- **Does NOT create tasks**: Documents findings for the developer to resolve\n- **Does NOT edit code**: Only reviews and reports\n- **Balances security with usability**: Risk-based approach\n- **Objective**: Documents vulnerabilities AND best practices\n","# Security Review\n\n## Security Principles\n\n| Principle | Application |\n|-----------|-------------|\n| **CIA Triad** | Confidentiality, Integrity, Availability in every assessment |\n| **Defense in Depth** | Multiple layers; never rely on a single control |\n| **Least Privilege** | Minimum permissions for each component |\n| **Secure by Default** | Default configurations must be secure |\n| **Zero Trust** | Never trust, always verify |\n| **Shift Left** | Detect issues early in design, not in production |\n\n## Mode Detection\n\nDetermine the operating mode from the calling agent's context:\n\n**Architectural Mode** (called from `plan`):\n- Handoff from the `plan` agent after ADR creation\n- Feature involves: auth, sensitive data, external APIs, payments\n\n**Code Mode** (called from `implement` or `review`):\n- Handoff from the `implement` agent after implementation\n- Reference to specific files or diff\n\n---\n\n## Architectural Mode (Design Security)\n\n### When to Execute\n\nThis mode is **mandatory** when the feature involves:\n\n| Trigger | Description |\n|---------|-------------|\n| Authentication\u002FAuthorization | Access control, identity, permissions |\n| Sensitive data | Information requiring protection (credentials, personal data) |\n| External integrations | Communication with systems outside the trust boundary |\n| Exposed endpoints | Interfaces accessible by users or external systems |\n| Data persistence | Storage of information that crosses boundaries |\n\n### Execution Flow\n\n1. **Read design artifacts**:\n   - `plan.md` - Stack and architecture\n   - `docs\u002Farchitecture\u002Fdecisions\u002F*.md` - ADRs\n   - `spec.md` - Requirements and user stories\n\n2. **Identify attack surface**:\n   ```\n   ## Attack Surface\n   \n   | Component | Exposure | Data | Initial Risk |\n   |-----------|----------|------|--------------|\n   | [endpoint] | [public\u002Finternal] | [data type] | [low\u002Fmedium\u002Fhigh] |\n   ```\n\n3. **Map trust boundaries**:\n   - Where does data cross trust boundaries?\n   - Which components are external vs internal?\n   - Where is authentication\u002Fauthorization applied?\n\n4. **Apply STRIDE** (simplified):\n\n   | Threat | Question | Typical Control |\n   |--------|----------|-----------------|\n   | **S**poofing | Can someone impersonate another? | Strong authentication |\n   | **T**ampering | Can data be altered? | Integrity, signatures |\n   | **R**epudiation | Can actions be denied? | Logging, audit trail |\n   | **I**nfo Disclosure | Can data leak? | Encryption, ACLs |\n   | **D**enial of Service | Can the system be taken down? | Rate limiting, quotas |\n   | **E**levation | Can privileges be escalated? | Least privilege, RBAC |\n\n5. **Evaluate ADRs**:\n   - Do technology decisions have security implications?\n   - Are there known vulnerabilities in the chosen technologies?\n   - Are default configurations secure?\n   - **For Microsoft\u002FAzure technologies**: Use `microsoft_docs_search` to check security best practices and known service vulnerabilities\n   - Use `microsoft_docs_fetch` to get the complete security hardening guide when a relevant gap is identified\n\n6. **Validate Azure compliance**:\n   - Use the `azure\u002Fpolicy` tool to verify whether the proposed infrastructure complies with the organization's policies\n   - Use the `azure\u002Frole` tool to verify whether the access model follows least privilege (RBAC)\n   - Use the `azure\u002Fwellarchitectedframework` tool for each Azure service in the architecture to get the security pillar guidance\n   - Include found violations as findings in the security report\n   - If policies block services proposed in the ADRs, record as a **High** finding\n\n7. **Generate report**:\n\n   ```markdown\n   # Security Review - [Feature]\n   \n   **Mode**: Architectural\n   **Date**: [date]\n   **Reviewer**: Copilot Security Agent\n   \n   ## Executive Summary\n   \n   **Verdict**: [APPROVED | APPROVED_WITH_CONTROLS | BLOCKED]\n   \n   [Summary in 2-3 sentences of the overall risk and main concerns]\n   \n   ## Attack Surface\n   \n   [Components table]\n   \n   ## STRIDE Analysis\n   \n   ### Findings\n   \n   | ID | Threat | Component | Severity | Status |\n   |----|--------|-----------|----------|--------|\n   | SEC-001 | [type] | [where] | [Critical\u002FHigh\u002FMedium\u002FLow] | OPEN |\n   \n   ### SEC-001: [Title]\n   \n   **Severity**: [Critical\u002FHigh\u002FMedium\u002FLow]\n   **Component**: [where]\n   **Description**: [what can happen]\n   **Impact**: [consequences]\n   **Recommendation**: [how to mitigate]\n   \n   ## Security Requirements\n   \n   Before proceeding to implementation:\n   \n   - [ ] [Requirement 1]\n   - [ ] [Requirement 2]\n   \n   ## ADR Decisions with Security Implications\n   \n   | ADR | Decision | Implication | Recommendation |\n   |-----|----------|-------------|----------------|\n   | [number] | [decision] | [risk] | [mitigation] |\n   ```\n\n8. **Save report**: Path: `docs\u002Ffeatures\u002F[feature]\u002Fsecurity-review-architecture.md`\n\n   Present the Reasoning Log in the format of the `reasoning` skill (use \"Discarded threats\" instead of \"Assumptions\" when applicable).\n\n9. **Return verdict**:\n\n   **If APPROVED**:\n   ```\n   Security Review: APPROVED\n   No blockers identified. Security requirements documented.\n   Proceed to task creation.\n   ```\n\n   **If APPROVED_WITH_CONTROLS**:\n   ```\n   Security Review: APPROVED WITH CONTROLS\n   Findings that need to be addressed during implementation:\n   - SEC-001: [title] (High)\n   - SEC-002: [title] (Medium)\n   Security requirements added to the spec.\n   Proceed to task creation with attention to controls.\n   ```\n\n   **If BLOCKED**:\n   ```\n   Security Review: BLOCKED\n   Critical issues preventing progress:\n   - SEC-001: [title] (Critical)\n   Action required: Review design before creating tasks.\n   ```\n\n---\n\n## Code Mode (Implementation Security)\n\n### Execution Flow\n\n1. **Identify scope**:\n   - If called from `implement`: review modified files\n   - If called from `review`: review files in review scope\n   - If explicit mention: review specified files\u002FPR\n\n2. **Read relevant files**:\n   - Modified source code\n   - Security tests (if they exist)\n   - Configurations (env, secrets, configs)\n\n3. **Check vulnerability categories**:\n\n   | Category | What to check |\n   |----------|---------------|\n   | **Access Control** | Authorization, privilege escalation, unauthorized access |\n   | **Data Protection** | Exposed sensitive data, inadequate encryption |\n   | **Injection** | Unsanitized input used in commands or queries |\n   | **Insecure Design** | Missing validation, violated trust boundaries |\n   | **Configuration** | Insecure defaults, debug in production |\n   | **Vulnerable Components** | Dependencies with known vulnerabilities |\n   | **Authentication** | Weak identity and session controls |\n   | **Integrity** | Data or code can be manipulated |\n   | **Logging** | Insufficient auditing or sensitive data in logs |\n   | **External Requests** | URLs or resources controlled by external input |\n\n4. **Code checks**:\n\n   Detect the project stack and apply relevant checks for:\n   - Dynamic code execution\n   - Command or data injection\n   - Deserialization of untrusted data\n   - File path manipulation\n   - Cross-site scripting\n   - Race conditions\n   - Denial of service\n\n5. **Check secrets**:\n   - Search for hardcoded credentials in the code\n   - Verify that environment files are in `.gitignore`\n   - Verify that secrets are not exposed in configuration\n   - Query `github\u002Flist_secret_scanning_alerts` for active alerts:\n     If there are open alerts, include them as Critical findings.\n\n6. **Check .gitignore**:\n   - Environment files should be ignored\n   - Local configuration files should be ignored\n   - Build\u002Fdependency directories should be ignored\n\n7. **Check dependencies**:\n   Use the appropriate audit tool for the project stack.\n   Supplement with GitHub data:\n   - `github\u002Flist_dependabot_alerts` for known vulnerabilities\n   - `github\u002Flist_code_scanning_alerts` for CodeQL alerts\n   - `github\u002Flist_repository_security_advisories` for advisories\n   - `github\u002Fget_global_security_advisory` for specific CVE details\n\n8. **Generate report**:\n\n   ```markdown\n   # Security Review - [Feature\u002FPR]\n   \n   **Mode**: Code\n   **Date**: [date]\n   **Scope**: [files\u002FPR]\n   **Reviewer**: Copilot Security Agent\n   \n   ## Executive Summary\n   \n   **Verdict**: [PASSED | PASSED_WITH_FINDINGS | FAILED]\n   \n   | Severity | Count |\n   |----------|-------|\n   | Critical | 0 |\n   | High | 1 |\n   | Medium | 2 |\n   | Low | 1 |\n   \n   ## Findings\n   \n   ### SEC-C001: [Title]\n   \n   **Severity**: High\n   **File**: `src\u002Fauth\u002Flogin.ts:42`\n   **Category**: A03 Injection\n   \n   **Vulnerable code**:\n   [code snippet]\n   \n   **Problem**: [description]\n   \n   **Remediation**:\n   [fix snippet]\n   \n   ## Security Checklist\n   \n   - [x] No hardcoded secrets\n   - [x] Input validation present\n   - [ ] Authorization verified on endpoints\n   \n   ## Dependencies\n   \n   | Package | Version | CVEs | Severity |\n   |---------|---------|------|----------|\n   | [pkg] | [ver] | [CVE-xxx] | High |\n   ```\n\n9. **Save report**: Path: `docs\u002Ffeatures\u002F[feature]\u002Fsecurity-review-code.md`\n\n10. **Return verdict**:\n\n    **If PASSED**:\n    ```\n    Code Security Review: PASSED\n    No vulnerabilities identified. Can proceed with PR.\n    ```\n\n    **If PASSED_WITH_FINDINGS**:\n    ```\n    Code Security Review: PASSED WITH FINDINGS\n    Low\u002Fmedium severity findings (non-blocking):\n    - SEC-C002: [title] (Medium)\n    Recommend fixing, but can proceed with PR.\n    ```\n\n    **If FAILED**:\n    ```\n    Code Security Review: FAILED\n    Critical\u002Fhigh vulnerabilities found:\n    - SEC-C001: [title] (High) - [file:line]\n    Mandatory fix before PR.\n    ```\n\n---\n\n## Severity\n\n| Level | Criteria | Action |\n|-------|----------|--------|\n| **Critical** | Trivial exploitation, maximum impact (RCE, massive data breach) | Blocks. Fix immediately. |\n| **High** | Exploitation possible, significant impact (auth bypass, injection) | Blocks. Fix before merge. |\n| **Medium** | Exploitation requires conditions, moderate impact | Non-blocking. Fix soon. |\n| **Low** | Difficult exploitation, limited impact | Non-blocking. Backlog. |\n| **Info** | Best practices, hardening | Informational. |\n\n## Recognized Best Practices\n\nAcknowledge when the code follows best practices:\n\n```\nBest practices identified:\n- Parameterized queries used consistently\n- Input validation with defined schema\n- Secrets loaded from environment variables\n- Rate limiting implemented on public endpoints\n```\n\n## Common Rationalizations\n\n| Rationalization | Reality |\n|---|---|\n| \"This is an internal tool, security does not matter\" | Internal tools get compromised. Attackers target the weakest link in the chain. |\n| \"We will add security later\" | Retrofitting security is 10x harder than building it in. Add controls now. |\n| \"The framework handles security\" | Frameworks provide tools, not guarantees. You still need to use them correctly. |\n| \"No one would try to exploit this\" | Automated scanners will find it. Security by obscurity is not security. |\n| \"It is just a prototype\" | Prototypes become production. Security habits from day one prevent emergency retrofits. |\n\n## Red Flags\n\n- User input passed directly to database queries, shell commands, or HTML rendering\n- Secrets in source code or commit history\n- API endpoints without authentication or authorization checks\n- Missing CORS configuration or wildcard origins\n- No rate limiting on authentication endpoints\n- Stack traces or internal error details exposed to users\n- Dependencies with known critical vulnerabilities not addressed\n\n## Constraints\n\n- **Does NOT implement code**: Provides guidance and remediation\n- **Does NOT create tasks**: Documents findings for the developer to resolve\n- **Does NOT edit code**: Only reviews and reports\n- **Balances security with usability**: Risk-based approach\n- **Objective**: Documents vulnerabilities AND best practices\n",{"name":5,"description":7},"main","fb93f96b64ff15238a7f20e7f611211ee0720fba",".github\u002Fplugins\u002Fdevsquad\u002Fskills\u002Fsecurity-review",12,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fdevsquad-copilot","https:\u002F\u002Faka.ms\u002Fdevsquad-copilot","https:\u002F\u002Fgithub.com\u002Fmicrosoft","https:\u002F\u002Fopensource.microsoft.com","Open source projects and samples from Microsoft","2026-11-02 14:37:46",{"source":8,"skillName":5,"commands":54,"prompt":64,"zipAvailable":65},[55,58,61],{"tool":56,"command":57},"npx","npx skills add microsoft\u002Fdevsquad-copilot --skill security-review",{"tool":59,"command":60},"bunx","bunx skills add microsoft\u002Fdevsquad-copilot --skill security-review",{"tool":62,"command":63},"pnpm","pnpm dlx skills add microsoft\u002Fdevsquad-copilot --skill security-review","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fdevsquad-copilot\u002Fblob\u002Fmain\u002F.github\u002Fplugins\u002Fdevsquad\u002Fskills\u002Fsecurity-review\u002FSKILL.md",true,[],[68,83,94,105,122,134],{"skillNo":69,"name":70,"nameZh":6,"description":71,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":72,"categories":73,"keywords":77,"publishedAt":38},"01M69BG4STFRJMC0FT9K81Y6W0","work-item-workflow","Work item workflow for implementation. Use when starting work on a GitHub issue or Azure DevOps work item to verify assignee, dependencies, priority, and capacity. Do not use for creating new work items (use work-item-creation), for suggesting the next task (use next-task), or when the work source is only tasks.md without an issue\u002Fwork item.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fdevsquad-copilot\u002Fblob\u002Fmain\u002F.github\u002Fplugins\u002Fdevsquad\u002Fskills\u002Fwork-item-workflow\u002FSKILL.md",[74],{"categoryNo":75,"categoryName":76,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[78,30,28,79,80,34,81,82],"work item workflow","azure devops","capacity","tasks","next task",{"skillNo":84,"name":85,"nameZh":6,"description":86,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":89,"publishedAt":38},"01M69BG2HPKFCG18SYZA7W35AK","work-item-creation","Rules and checklist for creating work items on GitHub Issues or Azure DevOps. Use when you need to create issues, user stories, tasks, epics, or features on the board. Do not use for platform configuration (use board-config), managing workflow of existing tasks (use work-item-workflow), or for comments on work items.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fdevsquad-copilot\u002Fblob\u002Fmain\u002F.github\u002Fplugins\u002Fdevsquad\u002Fskills\u002Fwork-item-creation\u002FSKILL.md",[],[90,28,30,79,91,34,81,92,93],"work item creation","config","create","github issues",{"skillNo":95,"name":96,"nameZh":6,"description":97,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":101,"publishedAt":38},"01M69BG04YGG1CR7MZWGQ7X9MG","triage-workflow","Label-based state machine for triaging issues and work items. Manages state transitions, generates durable triage artifacts, and supports resumable sessions. Use when triaging GitHub issues or Azure DevOps work items. Do not use for creating new work items from scratch (use work-item-creation) or for managing implementation workflow of already-triaged items (use work-item-workflow).","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fdevsquad-copilot\u002Fblob\u002Fmain\u002F.github\u002Fplugins\u002Fdevsquad\u002Fskills\u002Ftriage-workflow\u002FSKILL.md",[100],{"categoryNo":75,"categoryName":76,"taxonomyType":21,"taxonomyTypeDesc":22},[30,102,103,93,28,104,79,34],"triage workflow","triage","sessions",{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":114,"publishedAt":38},"01M69BFXK0ZC2JZEERD6TFTQ8G","test-discipline","Testing practices for behavior-focused, refactor-resistant tests. Use when implementing features, fixing bugs, refactoring, or adding or reviewing tests to ensure they verify intent through public interfaces and avoid tautological assertions. Also use when adding regression tests after bug fixes. Consulted by the implement agent during coding and by the review agent when validating test quality. Do not use for test strategy decisions (use complexity-analysis), for failure triage and root-cause analysis (use debugging-recovery, then after root cause is localized use test-discipline to add the reproducing regression test and fix), or for integration test infrastructure setup.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fdevsquad-copilot\u002Fblob\u002Fmain\u002F.github\u002Fplugins\u002Fdevsquad\u002Fskills\u002Ftest-discipline\u002FSKILL.md",[111],{"categoryNo":112,"categoryName":113,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",[115,116,117,118,24,119,103,120,121],"test discipline","test","infrastructure","testing","implement","setup","debugging",{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":128,"publishedAt":38},"01M69BFRCVSVDN7RXAZJSSZ4TW","reasoning","Record decisions and justifications during SDD agent execution, and pass structured context between agents via handoff envelope. Use when an agent needs to document decisions made (Reasoning Log) or perform a handoff to another agent. Do not use for architecture documentation (use ADRs), complexity analysis (use complexity-analysis), or debug logs.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fdevsquad-copilot\u002Fblob\u002Fmain\u002F.github\u002Fplugins\u002Fdevsquad\u002Fskills\u002Freasoning\u002FSKILL.md",[],[124,129,130,131,132,133],"complexity analysis","debug","architecture","documentation","handoff",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":143,"publishedAt":38},"01M69BFNT0BQ1MA4TZE0469T4H","quality-gate","Quality gate for SDD artifacts (specs, ADRs, tasks, code). Use when generating or updating specs, ADRs, task decomposition, or code implementation to validate quality before delivering to the user. Do not use for linting, code formatting, human code review, or validation of intermediate artifacts marked as draft\u002FWIP.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fdevsquad-copilot\u002Fblob\u002Fmain\u002F.github\u002Fplugins\u002Fdevsquad\u002Fskills\u002Fquality-gate\u002FSKILL.md",[140],{"categoryNo":141,"categoryName":142,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查",[144,81,145,24,36,146],"quality gate","validate","code review"]