feat: add security-review skill#560
Closed
Hnturk wants to merge 3 commits into
Closed
Conversation
Add a new discipline-enforcing skill that ensures code is reviewed for security vulnerabilities before merging. Covers input validation, auth, data exposure, dependencies, and configuration with actionable checklists.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review infoConfiguration used: Repository UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds a new security review skill document describing a security review checklist, deployment guardrails, the Hard Gate workflow, red flags, integration guidance, and process rules (Iron Law) for performing security reviews before merges. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@skills/security-review/SKILL.md`:
- Around line 18-20: Add language identifiers to the two fenced code blocks so
markdownlint MD040 is satisfied: for the block containing "NO MERGE WITHOUT
SECURITY CHECKLIST COMPLETION" and the block starting with "BEFORE claiming
merge-ready:" replace the opening triple backticks with triple backticks plus
"text" (i.e., ```text) so both fenced blocks explicitly declare the language.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@skills/security-review/SKILL.md`:
- Around line 26-30: Update the checklist under the "Always before:" heading in
SKILL.md to avoid blocking draft PRs: replace the list item "- Creating pull
requests" with a scoped requirement such as "- Marking a PR as merge-ready /
before final merge approval" (or similar wording) so the gate still enforces
checks prior to merge while allowing early/draft PRs for feedback; edit the
"Always before:" section and its list entry accordingly.
rahulsc
added a commit
to rahulsc/superpowers
that referenced
this pull request
Mar 1, 2026
Reject prose-only verdicts — require file:line citations per requirement. Add anti-skip enforcement in Red Flags. Add re-review loop bound (max 3 cycles, then escalate). Add security review tier for auth/payment/data tasks. Add per-implementer SHA guidance for team mode. Add uncommitted changes check (git status before dispatch). References canonical evidence format from verification-before-completion. Addresses obra#528, obra#463, obra#479, PR obra#560, PR obra#578, Findings T, V. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
rahulsc
added a commit
to rahulsc/superpowers
that referenced
this pull request
Mar 1, 2026
Reject prose-only verdicts — require file:line citations per requirement. Add anti-skip enforcement in Red Flags. Add re-review loop bound (max 3 cycles, then escalate). Add security review tier for auth/payment/data tasks. Add per-implementer SHA guidance for team mode. Add uncommitted changes check (git status before dispatch). References canonical evidence format from verification-before-completion. Addresses obra#528, obra#463, obra#479, PR obra#560, PR obra#578, Findings T, V. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
obra
added
enhancement
IgorTavcar
added a commit
to IgorTavcar/superpowers
that referenced
this pull request
Mar 9, 2026
Enforced security review checklist covering input validation, auth, data exposure, dependencies, and configuration. Upstream PR: obra#560 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
rahulsc
added a commit
to rahulsc/superpowers
that referenced
this pull request
Mar 10, 2026
Reject prose-only verdicts — require file:line citations per requirement. Add anti-skip enforcement in Red Flags. Add re-review loop bound (max 3 cycles, then escalate). Add security review tier for auth/payment/data tasks. Add per-implementer SHA guidance for team mode. Add uncommitted changes check (git status before dispatch). References canonical evidence format from verification-before-completion. Addresses obra#528, obra#463, obra#479, PR obra#560, PR obra#578, Findings T, V. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
obra
added
skills
Collaborator
|
Thanks for the contribution. We now have #1151 tracking the security-review workflow proposal, plus newer PRs that explore the fuller requesting-security-review + reviewer-agent shape. This PR predates that discussion and adds a standalone checklist-style security-review skill, which is not the direction we’d evaluate if we pursue this in core. Closing this so the security-review discussion stays consolidated on #1151 and the newer workflow-shaped proposals. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add a new discipline-enforcing skill that ensures code is reviewed for security vulnerabilities before merging. Covers input validation, auth, data exposure, dependencies, and configuration with actionable checklists