/security-deep-review — orchestrator¶
Runs 2 agents. Runs the same mandatory secret-scanner gate first, then a Workflow-tool pipeline — parallel specialist finders sweep independent lenses (injection/authz, SSRF/deserialization/path-traversal, supply-chain, crypto/authn, cloud/infra), each finding is adversarially re-checked by independent verifiers (majority-refute kills it), then one synthesis pass produces a severity-ranked BLOCK/WARN/PASS report. Diff-scoped by default; --full sweeps the whole repo. Deliberately invoked, not part of the default pre-push fleet.
The pipeline¶
What it runs, in order¶
| # | Agent | What it does |
|---|---|---|
| 1 | security-finder |
Use this agent as one of several parallel lens-scoped finders in the security-deep-review… |
| 2 | security-verifier |
Use this agent as an independent adversarial verifier in the security-deep-review… |
At a glance¶
| Class | review |
| Cost | typically 5 finder calls + up to 15 verifier calls (commonly 15–30 total agent calls for a mid-size diff) |
| Skill page | /security-deep-review |
| Source | skills/security-deep-review/SKILL.md |