/sdlc-security-review
Threat-model a change that touches auth, user data, external inputs, billing, or a public endpoint — catch the exposure before the internet does. Triggers on "security", "auth", "permissions", "PII", "external API", "public endpoint", "rate limit", "token". A conditional-risk
$ npx -y skills add swapnil-agrim/loopsmith --skill sdlc-security-review --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
- Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.
- You can call itInvoke it directly when you want it.
- Slash command
/sdlc-security-review
Context preview
The summary Claude sees to decide when to auto-load this skill.
Threat-model a change that touches auth, user data, external inputs, billing, or a public endpoint — catch the exposure before the internet does. Triggers on "security", "auth", "permissions", "PII", "external API", "public endpoint", "rate limit", "token". A conditional-risk
Guardrails + an overnight autopilot for your AI coding agent — one that plans before it codes, won't ship work that fights your strategy, and gets sharper every run.
Other skills on loopsmith.
- /sdlc-align
Periodic cumulative-drift audit — look at the last stretch of shipped goals as a whole and ask whether the work still matches the north-star's stated bets, or whether the strategy has been quietly rewritten by accumulation. Use when the user runs /sdlc-align, when /sdlc-status
Open skill - /sdlc-brainstorm
The Goal phase — turn an idea into an approved design before any code: explore intent, requirements, and constraints; ask one question at a time; propose 2-3 approaches with trade-offs; restate as one concrete, checkable goal. Use at Goal, or when the user runs /sdlc-brainstorm.
Open skill - /sdlc-context
Pre-flight recall — assemble a compact, cited "context brief" of prior art (knowledge graph + past issues + conventions) for a goal before running it, so a crucial earlier finding is never missed just because the context window flushed. Use at the start of a goal when the
Open skill - /sdlc-contract-check
Detect breaking changes to public APIs, event shapes, exported types, CLI flags, or env vars before consumers hit them. Triggers on "breaking change", "API change", "contract", "consumers", "exported type", "event shape", "route change". A conditional-risk review orthogonal to
Open skill - /sdlc-debug
Diagnose a bug hypothesis-first, reproduce-as-a-test-first — before writing any fix. Triggers on "bug", "broken", "not working", "error", "exception", "investigate", "why is X". A conditional-risk skill orthogonal to sdlc-review; always LoopSmith's own (no companion equivalent).
Open skill - /sdlc-decide
Record an architectural decision as a machine-checkable invariant so an edit that breaks it is DENIED, not just discouraged. Use when the user runs /sdlc-decide, says "make this a rule / an invariant", "enforce this", "stop us breaking X", or after a retrospective proposes a
Open skill