Rondoflow Reviewer — Security agent for Claude Code
Reviews a RondoFlow code change against this project's specific conventions and security rules (child_process spawn safety, the { success, error } API envelope, per-user ownership/IDOR, Zod boundary v.
How to install Rondoflow Reviewer
Installs to ~/.claude/agents/rondoflow-rondoflow-rondoflow-reviewer.md
mkdir -p ~/.claude/agents && curl -fsSL https://raw.githubusercontent.com/rondoflow/rondoflow/HEAD/.claude/agents/rondoflow-reviewer.md -o ~/.claude/agents/rondoflow-rondoflow-rondoflow-reviewer.md Restart Claude Code, or start a new session, for it to be picked up.
What Rondoflow Reviewer does
name: rondoflow-reviewer description: Reviews a RondoFlow code change against this project's specific conventions and security rules (child_process spawn safety, the { success, error } API envelope, per-user ownership/IDOR, Zod boundary validation, immutability, i18n parity, file/function size limits, Claude-auth handling). Use after writing or before committing non-trivial changes to packages/server or packages/ui, or when the user asks for a review focused on RondoFlow's rules. Read-only —
Alternatives in Security
- Gitnexus Security Boundary Reviewer — GitNexus security and trust-boundary reviewer 45.8k ★
- Fleet Security Auditor — Fleet-specific security analysis covering MDM, osquery, API auth, and device management threat models 6.8k ★
- JS Error Handler Auditor — Use this agent when you need to audit a JavaScript codebase for unhandled errors in top-level async operations 6.1k ★
Full documentation available on GitHub
View Source RepositoryRelated Agents
Process Observer Audit
Compliance audit sub-agent. Reviews session against CLAUDE.md behavioral guidelines — branching conventions, C
Ddw Arch Auditor
Read-only architecture auditor. Spawn it in PLAN to check a proposed spec against the project's conventions, a
Daw Arch Auditor
Read-only architecture auditor. Spawn it in PLAN to check a proposed spec against the project's conventions, a
AI Security
Security review for a change in a project with .ai/ — authentication, authorization, secrets, personal and pay
Security Testing
Security Testing Agent (SSDF PW.8). Read-only w.r.t. product code. Derives tests from requirements + threat mo
Kuma Guardian
Runtime safety guardian. Pre-flight check, architecture boundary audit, circular dependency detection, and ant
Related Skills
Review API Contracts
Audit API boundary code for contract drift: response envelope consistency, error response shapes, HTTP status-
API Contract Review
API platform contract review. Invokes api-platform-reviewer to audit rate-limit design, OAuth scope hygiene, w
Rust Review
Comprehensive Rust code review for ownership, lifetimes, error handling, unsafe usage, and idiomatic patterns.
