From 1dfbf08c0e4c043834446c1432b3b33a5b6afe46 Mon Sep 17 00:00:00 2001
From: kingboung <kingboungli@gmail.com>
Date: Wed, 15 Apr 2026 16:14:00 +0800
Subject: [PATCH] =?UTF-8?q?feat:=20=E6=9B=BF=E6=8D=A2=E5=86=85=E7=BD=AE=20?=
 =?UTF-8?q?security-review=20=E4=B8=BA=20CoStrict=20Security=20=E7=89=88?=
 =?UTF-8?q?=E6=9C=AC?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 移除原版 security-review 内置命令（占位 plugin 迁移提示）
- 将 CoStrict Security skill 命令名从 strict-security-review 改为 security-review
- 更新 description 和 whenToUse 描述

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 src/commands.ts                          | 3 +--
 src/costrict/skill/codeReviewSecurity.ts | 6 +++---
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/src/commands.ts b/src/commands.ts
index d7ab5b945..52bf753d0 100644
--- a/src/commands.ts
+++ b/src/commands.ts
@@ -50,7 +50,7 @@ const agentsPlatform =
     ? require('./commands/agents-platform/index.js').default
     : null
 /* eslint-enable @typescript-eslint/no-require-imports */
-import securityReview from './commands/security-review.js'
+
 import bughunter from './commands/bughunter/index.js'
 import terminalSetup from './commands/terminalSetup/index.js'
 import usage from './commands/usage/index.js'
@@ -341,7 +341,6 @@ const COMMANDS = memoize((): Command[] => [
   review,
   ultrareview,
   rewind,
-  securityReview,
   terminalSetup,
   upgrade,
   extraUsage,
diff --git a/src/costrict/skill/codeReviewSecurity.ts b/src/costrict/skill/codeReviewSecurity.ts
index f69444afc..d5c98552f 100644
--- a/src/costrict/skill/codeReviewSecurity.ts
+++ b/src/costrict/skill/codeReviewSecurity.ts
@@ -6,10 +6,10 @@ export function registerCodeReviewSecuritySkill(): void {
   const skillMd = files['SKILL.md'] ?? ''
 
   registerBundledSkill({
-    name: 'strict-security-review',
-    description: 'Systematic code security audit — identifies vulnerabilities like SQL injection, XSS, command injection, SSRF, etc.',
+    name: 'security-review',
+    description: 'CoStrict Security — identifies code vulnerabilities including SQL injection, XSS, command injection, SSRF, path traversal, deserialization, and business logic flaws',
     whenToUse:
-      'Use when the user requests a code audit, security audit, or vulnerability scan; or mentions /code-review-security, /audit, or wants a security check before deployment',
+      'Use when the user requests a code audit, security audit, vulnerability scan, or wants to review vulnerabilities before deployment. Also triggers on /security-review.',
     userInvocable: true,
     files,
     async getPromptForCommand() {