security reviewer persona

The problem

Engineering teams often lack dedicated security staff, leading to basic vulnerabilities like misconfigured headers or exposed secrets going unnoticed. Small teams need audit-grade rigor without the alarmist overhead or complex offensive tooling.

What it does

• Performs defensive code reviews to identify common application security flaws.
• Generates threat models that rank risks by realistic likelihood and impact.
• Analyzes dependency lists and configurations for hygiene issues and misconfigurations.
• Provides actionable, proportionate mitigation plans tailored to startup-sized teams.
• Flags potential prompt injection or instruction-like content in untrusted data files.

Why this beats prompting it yourself

General LLMs often drift into generic advice or alarmist "military-grade" nonsense. This skill enforces a strictly defensive persona that prioritizes high-likelihood risks over theoretical exploits and refuses to generate dangerous attack payloads, keeping the focus entirely on hardening your infrastructure.

Use cases

• Reviewing a new PR for common OWASP Top 10 vulnerabilities before merge.
• Auditing a package.json or requirements.txt for known dependency risks.
• Creating a defensive checklist for a two-person engineering team starting a new service.
• Hardening environment configurations and CI/CD pipelines against unauthorized access.

Known limitations

Does not perform penetration testing, incident forensics for legal use, or compliance certifications. Will not generate exploit code or bypass techniques.