From secops-factory
Use when performing multi-pass adversarial convergence review of security analyses. Dispatches security-reviewer in fresh-context passes with strict-binary novelty until convergence. Quality thresholds: >=7.0/10 overall, no dimension <5.0.
How this skill is triggered — by the user, by Claude, or both
Slash command
/secops-factory:adversarial-review-secops <ticket-id><ticket-id>security-reviewerThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
THE CONVERGENCE LOOP SKILL. Dispatches the security-reviewer agent in fresh-context passes to achieve adversarial convergence on security analysis quality.
THE CONVERGENCE LOOP SKILL. Dispatches the security-reviewer agent in fresh-context passes to achieve adversarial convergence on security analysis quality.
NO QUALITY SIGN-OFF WITHOUT ADVERSARIAL CONVERGENCE FIRST
A single review pass systematically misses things. Convergence requires minimum 2 passes with strict-binary novelty classification. The adversary has not seen prior passes -- that asymmetry is the mechanism.
Before any other action, say verbatim:
I am using the adversarial-review-secops skill to run convergence review passes on .
| Thought | Reality |
|---|---|
| "One pass found nothing, we're converged" | Zero findings after one pass is a prompt bug, not convergence. Min 2 passes. |
| "I'll summarize the prior pass for the reviewer" | Destroys information asymmetry. Dispatch with only the artifact. |
| "The reviewer and I agree, no need for pass 2" | Agreement after 1 pass is not convergence. Run pass 2. |
| "This finding is minor, I'll downgrade it" | Severity is the reviewer's call, not the orchestrator's. Record as-is. |
| "Same finding keeps appearing" | It keeps appearing because it isn't fixed. Fix it, then re-run. |
| "Novelty is LOW after pass 1" | Minimum 2 passes. No exceptions. LOW after 1 is not convergence. |
| "The quality score is 6.8, close enough to 7.0" | Threshold is >=7.0. Close is not passing. Fix and re-run. |
| "I'll skip cognitive bias audit this pass" | Bias audit is mandatory per pass. Invisible biases are the most dangerous. |
Strict-binary novelty prevents premature convergence, but it has a failure mode: reviewers fabricate findings to justify their existence. Every reviewer dispatch MUST include this clause verbatim:
Honest convergence is required. If you find fewer than 3 substantive items, declare convergence and emit no updated file — say "converged, no file emitted." Do not invent findings to justify this pass. Fabricating findings wastes analyst time, erodes trust in the review process, and is strictly worse than stopping. The orchestrator prefers an honest NITPICK over a padded SUBSTANTIVE.
Round 1 review outputs are systematically susceptible to these failure modes. Round 2+ prompts should instruct the reviewer to audit prior findings for these classes:
After each pass, classify every finding as one of:
Convergence criterion: A pass where ALL findings are NITPICK = converged.
For each pass, the reviewer focuses on attack surfaces derived from quality checklists:
CVE Enrichment Attack Surfaces:
Event Investigation Attack Surfaces:
Each pass MUST include a cognitive bias assessment:
Reference: ${CLAUDE_PLUGIN_ROOT}/data/cognitive-bias-patterns.md
If thresholds not met after convergence: flag for analyst rework with specific guidance.
The security-reviewer may run in a sandbox where Write is denied. Every reviewer dispatch MUST include this instruction verbatim:
CRITICAL DELIVERY INSTRUCTION: Do NOT use the Write tool. Return all deliverables inline, delimited with
=== FILE: <filename> ===on its own line followed by the complete file content. Use ASCII only — no HTML entity encoding. The orchestrator persists the files after receiving your return. This is NOT a fallback — this IS the approved delivery mode for this dispatch.
The orchestrator parses the return for === FILE: ... === delimiters and writes each block to disk.
The adversarial review convergence workflow lives in agents/orchestrator/review-convergence-workflow.md and is the authoritative source. This skill is the entry point; the orchestrator file is the playbook. If the two disagree, the orchestrator file wins.
After convergence (or max passes):
${CLAUDE_PLUGIN_ROOT}/data/review-best-practices.md${CLAUDE_PLUGIN_ROOT}/data/cognitive-bias-patterns.md${CLAUDE_PLUGIN_ROOT}/checklists/npx claudepluginhub drbothen/claude-mp --plugin secops-factoryProvides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.