security-review

Dev-time security audit of KarvyLoop's OWN source (twin of /code-review, but for security). Use when asked to "audit the security of these changes", "审这轮改动的安全", "security review this endpoint/diff", or before landing anything that touches the untrusted-input frontier (new API endpoints, URL/file fetch, tool authorization, sandbox, LLM output that reaches a persistent store or the shell). Runs a multi-agent adversarial audit — parallel discovery agents, then ≥3 refutation passes per finding (keep only if ≥2/3 say REAL) — and REPORTS ONLY; it never edits code. Not a KarvyLoop product feature.