feat(setup-aiengineering): add security review lens 5d to verification gate 5

[jsifalda]

Summary

• Adds a fourth parallel review lens (5d) to the verification protocol this skill injects, invoking the harness's built-in security review (Claude Code: /security-review). Defaults on, deselectable in the Step 4 module menu, self-gates on host availability. Triage mirrors 5b: critical/major auto-apply then re-run gates 1-3, minor/info get listed. Gate 5 covered correctness, general review, and structure, but nothing owned vulnerability classes specifically.
• Makes gate 5 count-agnostic ("every lens below" rather than "all three"), so a deselected 5d needs no conditional rewrite and a future 5e needs no edit there.
• Adds Step 9b, a suggestion-only nudge for the security-guidance plugin, gated on Claude Code + 5d selected + plugin absent. The plugin is a separate hooks-only layer (pattern warnings, LLM diff review on stop, agentic review on commit), not the source of /security-review, which is a Claude Code built-in needing no install. The skill never installs it.
• Bumps baseline Skill version v3 to v4 with two matching checklist rows, so re-runs offer both concerns to repos already stamped v3.

Summary by CodeRabbit

• New Features

  • Added an optional, default-enabled security review to code verification, covering common vulnerabilities such as injection, XSS, SSRF, and authentication bypasses.
  • Critical and major security findings can be automatically addressed and rechecked; lower-severity findings are reported for review.
  • Added a Claude Code-only suggestion for the optional security-guidance plugin when applicable.

• Documentation

  • Updated the setup guidance and baseline checklist to Skill version v4.
  • Clarified security review availability, selection, and reporting behavior.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f4747741-2d6f-439f-b537-9f62dad0d85e

📥 Commits

Reviewing files that changed from the base of the PR and between 1a261a9 and b3fbf6f.

📒 Files selected for processing (4)

• changelog/20260716141500-security-review-lens-5d.md
• skills/setup-aiengineering/SKILL.md
• skills/setup-aiengineering/references/baseline-checklist.md
• skills/setup-aiengineering/references/verification-protocol.md

---

📝 Walkthrough

Walkthrough

Adds a default-on, deselectable security-review lens 5d to gate 5, with capability gating and severity triage. Adds a Claude Code-only, suggestion-only security-guidance plugin offer, updates reporting and baseline tracking, and bumps the skill version to v4.

Changes

Security Review Lens

Layer / File(s)	Summary
Module selection and plugin offer skills/setup-aiengineering/SKILL.md	Adds lens 5d to Step 4, conditionally injects it into gate 5, reports whether it ran or was skipped, and adds the gated Step 9b plugin suggestion.
Gate 5 security execution skills/setup-aiengineering/references/verification-protocol.md	Makes lens execution count-agnostic and adds conditional security review execution, triage, skip handling, and merged findings.
Versioned baseline and release record skills/setup-aiengineering/references/baseline-checklist.md, changelog/*	Bumps the baseline to v4, records the two security-related concerns, and documents the release changes.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Step4ModuleSelection
  participant SKILL.md
  participant VerificationProtocol
  participant Step9bPluginOffer
  Step4ModuleSelection->>SKILL.md: Select security review lens 5d
  SKILL.md->>VerificationProtocol: Inject conditional gate 5 lens
  VerificationProtocol->>VerificationProtocol: Run or skip security review and merge findings
  SKILL.md->>Step9bPluginOffer: Evaluate Claude Code plugin suggestion

Loading

Possibly related PRs

• jsifalda/ai-project-rules#71: Extends the Step 4 module catalog and injected-versus-skipped reporting wiring.
• jsifalda/ai-project-rules#83: Adds an optional gate 5 review lens and waits for all lenses before merging findings.
• jsifalda/ai-project-rules#84: Updates the versioned baseline and gate 5 protocol for an additional security-review lens.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/security-review-lens-5d

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}