security-reviewer-workflow
openbooklet.com/s/security-reviewer-workflowopenbooklet.com/s/[email protected]GET /api/v1/skills/security-reviewer-workflowUse when reviewing authentication, authorization, dependencies, configuration, release surfaces, sensitive data, logging, validation, CORS, secrets, or external-service risk as the Security Reviewer.
Use after code or configuration changes to prove the changed behavior with minimal sufficient commands, HTTP/browser checks, or static evidence. DO NOT USE FOR: purely speculative review without a concrete change.
Use when an agent needs the shared best-copilot contract for source priority, runtime adapters, init gates, work modes, dispatch packets, review, verification, memory, spec, or closeout.
Use when implementing a frozen subtask, staying inside assigned files, or reviewing Technical Architect-owned code as the Developer.
Use after meaningful task closeout, repeated failure, review loops, stale triggers, or user feedback that an agent/skill/workflow should improve. Turns verified signals into auditable, bounded evolution proposals for agents, skills, memory, and README guidance. DO NOT USE FOR: speculative prompt tweaks without evidence, direct autonomous rewrites, or changing user-facing behavior without PM review.
Use inside repo-init-scan to try `/init` or `copilot init`, normalize official init output into `.github/instructions/project.instructions.md`, and decide whether manual fallback is still needed.
Use after repo-init-gate fails, or when explicit reinitialization/repair is requested, to orchestrate the official init stage and the manual fallback stage.
Use when concrete failure evidence requires root-cause analysis, minimal patching, and regression proof as the Root Cause Fixer.
Use when failure evidence already exists and the likely file set is narrow. Finds the root cause and guides the smallest safe fix.
Use when target files are unknown, repeated search is becoming expensive, an agent is about to do broad repo-wide scanning, or a regex search is being considered. DO NOT USE FOR: explicit user paths or already frozen files_involved.
Compatibility entrypoint for runtimes that resolve the Senior Project Expert name as a skill instead of the Senior Project Expert agent. Runs the same init preflight before PM/coordinator workflow.
Use when coordinating large, ambiguous, cross-module, multi-agent, planning, dispatch, fan-in, closeout, or workflow-evolution work as the Senior Project Expert.
Use when requirements or spec are clear and the implementation should be a minimal, repo-pattern-compatible diff. DO NOT USE FOR: unclear direction, broad redesign, or tasks without enough file/context evidence.
Use when maintaining requirements, design, tasks, ADRs, execution-plan state, closeout records, or memory/spec recovery as the Specification Writer.
Create the target repository's local AI instruction scaffold during first-use bootstrap. Use from repo-init-scan when `.github/instructions`, runtime adapters such as `AGENTS.md` / `CLAUDE.md`, or the neutral project facts scaffold are missing. Do not use to overwrite existing project-specific rules.
Create the target repository's local memory skeleton after repo init. Use from repo-init-scan during first substantial plugin use, when `memories/repo` is missing, or when MEDIUM/LARGE work needs persistent recovery state. Do not store active project memory in the plugin package.
Use when writing or reviewing Python code, fixing lint/docstring/import/naming/exception/type annotation issues, unifying team style, or migrating `.py` files toward Google style.
Use when owning full-stack architecture, SDD design brainstorming, backend/frontend integration, service boundaries, data models, API contracts, runtime behavior, mainline implementation strategy, parallel decomposition, or Developer/Frontend Designer-code review as the Technical Architect.
Use after frontend page, component, style, route, form, or interaction changes to verify browser behavior and visual quality with real evidence.
Auto-indexed from funky-eyes/best-copilot
Are you the author? Claim this skill to take ownership and manage it.
Related Skills
graceful-error-recovery
Use this skill when a tool call, command, or API request fails. Diagnose the root cause systematically before retrying or changing approach. Do not retry the same failing call without first understanding why it failed.
audience-aware-communication
Use this skill when writing any explanation, documentation, or response that will be read by someone else. Match vocabulary, depth, and format to the audience's expertise level before writing.
Refactoring Expert
Expert in systematic code refactoring, code smell detection, and structural optimization. Use PROACTIVELY when encountering duplicated code, long methods, complex conditionals, or any code quality issues. Detects code smells and applies proven refactoring techniques without changing external behavior.
Research Expert
Specialized research expert for parallel information gathering. Use for focused research tasks with clear objectives and structured output requirements.
clarify-ambiguous-requests
Use this skill when the user's request is ambiguous, under-specified, or could be interpreted in multiple ways. If proceeding with a wrong assumption would waste significant work, always ask exactly one focused clarifying question before doing anything.
structured-step-by-step-reasoning
Use this skill for any problem that involves multiple steps, tradeoffs, or non-trivial logic. Think out loud before answering to improve accuracy and transparency. Apply whenever the answer is not immediately obvious.