在執行 Security Review、deterministic security intake、attack-surface mapping、exploit-path validation，或撰寫結構化 security findings 時使用。
用途：降低 Security Review 執行摩擦。 這不是新的 gate 規格來源，也不負責決定是否觸發 Security Review；觸發條件與欄位契約仍以
.github/workflow-core/AGENT_ENTRY.md第 3 節為唯一來源。
當任務已命中 Security Review trigger，或 user / Coordinator 明確要求安全審查時，Security Reviewer 可先依本 helper 完成 intake，再開始寫正式審查結果。
code-reviewer：做 Python 檔案 / 目錄 / diff 的自動 pre-scan，幫你先抓語法、明顯 secret、危險 API 使用、基本 maintainability 與部分 security smell。security-review-helper：做 exploitability 導向的深度審查，回答「這條路徑能不能真的被打？impact 是什麼？要不要擋 QA？」結論：code-reviewer 不能取代 Security Review；它只能降低人工審查成本。
.github/workflow-core/roles/security.mdEXECUTION_BLOCK 已存在以下欄位：
security_review_requiredsecurity_review_trigger_sourcesecurity_review_trigger_matchessecurity_review_conclusion若 trigger 已命中但 Plan 尚未回填上述欄位：
code-reviewer 做 pre-scan。在開始寫 finding 前，先跑一次 code-reviewer 當 pre-scan：
# 單檔
python .github/workflow-core/skills/code-reviewer/scripts/code_reviewer.py path/to/file.py
# 目錄
python .github/workflow-core/skills/code-reviewer/scripts/code_reviewer.py src/
# diff
git diff --no-color > /tmp/security-review.diff
python .github/workflow-core/skills/code-reviewer/scripts/code_reviewer.py /tmp/security-review.diff .
# 或直接吃 git diff
python .github/workflow-core/skills/code-reviewer/scripts/code_reviewer.py git diff --staged .
python .github/workflow-core/skills/code-reviewer/scripts/code_reviewer.py git diff main..HEAD .
用途：
完整的 intake、攻擊面速查表、Hypothesis 模板、Severity / Confidence 準則、Decision rubric 與自檢清單，請閱讀：
.github/workflow-core/skills/security-review-helper/references/security_checklist.md## 🔐 Security Review
### Trigger
- source:
- matches:
### Scope
- Reviewed files:
- Related trust boundaries:
### Findings
| ID | Severity | Confidence | File/Area | Issue | Evidence | Exploit Path | Recommendation |
|----|----------|------------|-----------|-------|----------|--------------|----------------|
### Coverage Gaps
- [哪些區域沒審到 / 哪些 runtime context 缺失，導致只能保留 uncertain]
### Rejected Hypotheses
- [已考慮但證偽的假說]
### Decision
- PASS / PASS_WITH_RISK / FAIL