deep-review: consider composing the built-in security-review skill into the Correctness & Security agent

Goal

Evaluate whether deep-review's Correctness & Security subagent should invoke the built-in security-review skill via the Skill tool, instead of carrying its entire threat checklist inline in the Step 2 prompt.

Background

Step 2 of plugins/deep-review/commands/deep-review.md hands the Correctness & Security agent a fixed, hand-maintained list of concerns: "logic errors, off-by-one errors, null/undefined handling, race conditions, SQL injection, XSS, insecure deserialization, hardcoded secrets, auth bypasses, input validation gaps." That list is a snapshot — it only improves when someone remembers to edit the markdown.

Claude Code ships a built-in security-review skill ("Complete a security review of the pending changes on the current branch"). The composition is already mechanically possible: deep-review.md sets disable-model-invocation: false in its frontmatter precisely so agents can invoke it through the Skill tool, and that door swings both ways — a subagent can invoke a skill.

Worth being clear about what this is not: a skill is not an agent type. It cannot be passed as subagent_type and it cannot restrict an agent's tools. This issue is about where the security prompt content comes from; tool restriction is a separate concern tracked in #178. The two are independent and can be decided in either order.

Open questions to resolve before implementing

• Scope mismatch. security-review targets pending changes on the current branch. deep-review reviews BASE_REF...HEAD plus uncommitted work, and supports branch:<name> and base:<name> overrides. Does the skill honor the same range, or would it review the wrong diff when those overrides are in play?
• Duplicate findings. Both passes would flag the same injection or secret. Step 2 already requires reconciling subagent output ("discard findings that are false positives or duplicates"), but this would meaningfully increase the dedupe load. Is that a net win?
• Output contract. The subagent must return SEVERITY|file:line|description lines. security-review has its own output format. Can the agent reliably translate, or does the contract break?
• Value over the inline list. Does the skill actually surface findings the current inline prompt misses? Worth a side-by-side run on a branch with known issues before committing to the change.

Acceptance criteria

• A decision is recorded: compose the skill, or keep the inline list and close this.
• If composing: /deep-review still emits the five-section format with no duplicated findings and no regression in coverage.
• If closing: note why, so the question is not re-litigated later.

Related

• #178 — define plugin-local read-only reviewer agents instead of defaulting to general-purpose (tool restriction; independent of this)

Start by reading Step 2 in plugins/deep-review/commands/deep-review.md and comparing its inline checklist with the built-in security-review skill. Run a side-by-side review on a branch with known issues, including the documented branch and base overrides, to assess scope, duplicate findings, and output translation. Done means recording a compose-or-close decision and verifying the stated acceptance criteria if composition is chosen.