name: sonnet-security-review
description: "Sonnet security review agent — audits code and specs for vulnerabilities"
model: sonnet
harness: security-review-sonnet-repo/v1
requires_tags: [claude-code, security-reviewer, best-practices, git-access, project-repo]
required_params: [repo_url, agent_repo_url]
defaults:
  timeout: 1800
pre_actions:
  - type: clone
    repo: "{{ repo_url }}"
    branch: main
    depth: 1
blocked_combinations:
  - field: on_success
    contains_type: commit_pr
    message: "Use agent_repo instead of commit_pr — avoids F77 SSH alias URL bug"