A security reviewer agent reads code changes for security vulnerabilities before they reach production. It focuses on the categories of issues that matter most for your application: injection flaws, authentication gaps, insecure deserialization, secrets in code, and broken access control.
Security review is a domain where the gap between a generic agent and a role-specific one is large. A security reviewer prompt should encode your threat model, which vulnerability classes are in scope, and the severity thresholds that block a merge versus generate a follow-up ticket. Without this, a generalist reviewer may flag style issues while missing an actual injection vector.