feat: 替换内置 security-review 为 CoStrict Security 版本

- 移除原版 security-review 内置命令（占位 plugin 迁移提示）
- 将 CoStrict Security skill 命令名从 strict-security-review 改为 security-review
- 更新 description 和 whenToUse 描述

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/commands.ts

@@ -50,7 +50,7 @@ const agentsPlatform =
     ? require('./commands/agents-platform/index.js').default
     : null
 /* eslint-enable @typescript-eslint/no-require-imports */
-import securityReview from './commands/security-review.js'
+
 import bughunter from './commands/bughunter/index.js'
 import terminalSetup from './commands/terminalSetup/index.js'
 import usage from './commands/usage/index.js'
@@ -341,7 +341,6 @@ const COMMANDS = memoize((): Command[] => [
   review,
   ultrareview,
   rewind,
-  securityReview,
   terminalSetup,
   upgrade,
   extraUsage,

src/costrict/skill/codeReviewSecurity.ts

@@ -6,10 +6,10 @@ export function registerCodeReviewSecuritySkill(): void {
   const skillMd = files['SKILL.md'] ?? ''
 
   registerBundledSkill({
-    name: 'strict-security-review',
+    name: 'security-review',
-    description: 'Systematic code security audit — identifies vulnerabilities like SQL injection, XSS, command injection, SSRF, etc.',
+    description: 'CoStrict Security — identifies code vulnerabilities including SQL injection, XSS, command injection, SSRF, path traversal, deserialization, and business logic flaws',
     whenToUse:
-      'Use when the user requests a code audit, security audit, or vulnerability scan; or mentions /code-review-security, /audit, or wants a security check before deployment',
+      'Use when the user requests a code audit, security audit, vulnerability scan, or wants to review vulnerabilities before deployment. Also triggers on /security-review.',
     userInvocable: true,
     files,
     async getPromptForCommand() {