Given a GitHub issue, review the issue for security implications. You'll make a determination if the claim in the issue is legitimate and should be addressed or will be a "won't fix." Trigger keywords - security issue, review security ticket, review security issue.
Review an issue that outlines a security, vulnerability, or privacy concern.
gh CLI must be authenticated (gh auth status)All comments posted by this skill must begin with the following marker line so that prior reviews can be detected and human comments can be distinguished from agent comments:
> **🔒 security-review-agent**
This marker is used in Step 2 to detect prior reviews and in Step 5 to distinguish agent comments from human comments.
The user will provide an issue ID (e.g., #42 or 42). Strip any leading # and fetch the issue contents.
gh issue view <id>
To also retrieve the full issue body as JSON (useful for parsing):
gh issue view <id> --json title,body,state,labels,author
First, check the issue's labels from the metadata fetched in Step 1.
state:agent-ready label, the issue has already been reviewed and is ready for implementation. There is no review to perform. Report to the user that this issue is already reviewed and marked as state:agent-ready, and suggest using the fix-security-issue skill instead. Stop.Next, fetch existing comments on the issue:
gh issue view <id> --json comments --jq '.comments[].body'
Search the comments for the agent marker (> **🔒 security-review-agent**).
Pass the issue title, description, and any relevant code references to the principal-engineer-reviewer sub-agent for analysis. Use the Task tool:
Task tool with subagent_type="principal-engineer-reviewer"
In the prompt, instruct the reviewer to approach the issue with a security-focused lens, specifically evaluating:
Based on the analysis from Step 3, post a comment on the issue.
Post a comment with a remediation plan:
gh issue comment <id> --body "$(cat <<'EOF'
> **🔒 security-review-agent**
## Security Review
**Determination:** Legitimate concern
### Summary
<1-3 sentences describing the security issue and its impact>
### Severity Assessment
- **Impact:** <high / medium / low>
- **Exploitability:** <description of attack vector and prerequisites>
- **Affected components:** <list of affected code paths or services>
### Attack Scenario
Step-by-step from the attacker's perspective:
1. <attacker's first action — e.g., crafts a malicious payload>
2. <attacker's second action — e.g., sends request to endpoint>
3. <resulting impact — e.g., gains access to sensitive data>
### Remediation Plan
1. <step 1 with file/component references>
2. <step 2>
3. ...
### Additional Notes
<any caveats, trade-offs, or related concerns>
EOF
)"
Post a comment with a rationale:
gh issue comment <id> --body "$(cat <<'EOF'
> **🔒 security-review-agent**
## Security Review
**Determination:** Not actionable
### Rationale
<clear explanation of why this is not a security concern, including any mitigating factors already in place>
### References
<links to documentation, code, or standards that support the determination>
EOF
)"
state:review-ready LabelAfter posting the review comment (whether legitimate or not actionable), add the state:review-ready label to the issue:
gh issue edit <id> --add-label "state:review-ready"
This signals to humans and downstream skills (e.g., fix-security-issue) that the review is complete.
After posting (or if a prior review exists with new human comments), review all comments that do not contain the > **🔒 security-review-agent** marker. These are human comments.
For each unanswered human comment:
Important: The authenticated user posting these comments may be a real person's account. Humans may reply to your comments directly. Always use the agent marker to distinguish your comments from theirs.
| Command | Description |
|---|---|
gh issue view <id> | View issue details |
gh issue view <id> --json title,body,state,labels,author | Fetch full issue metadata as JSON |
gh issue view <id> --json comments --jq '.comments[].body' | Fetch all comments on an issue |
gh issue comment <id> --body "..." | Post a comment on an issue |
gh issue edit <id> --add-label "state:review-ready" | Add a label to an issue |
User says: "Review security issue #42"
gh issue view 42security-review-agent markerprincipal-engineer-reviewer with security lensstate:review-ready label to the issueUser says: "Check on security issue #42 again"
security-review-agent review from a prior run