security-audit

1# Security Audit
2 
3Find vulnerabilities that violate a real trust boundary, then give owners the source evidence, safe reproduction, priority, and smallest effective fix. This is a defensive, source-first workflow. A candidate without a concrete affected principal, resource, or security outcome is not a confirmed finding.
4 
5## Operating modes
6 
7This skill is guidance by default. Loading it does not authorize the complete audit workflow or file creation.
8 
9- **Guidance mode**: For security questions, focused reviews, methodology, triage, or investigation of specific findings, use only the relevant parts of this skill. Do not automatically run all six phases, create an output directory, or write audit artifacts. You may launch focused agents when useful; they return results to the current task.
10- **Full audit mode**: Use the complete workflow when the user explicitly asks to audit or pen-test a codebase, asks for a full, comprehensive, or end-to-end security review, or requests report artifacts. Run all six phases and write the files defined below.
11 
12If the request could mean either mode, ask one focused question before creating files or starting the complete workflow.
13 
14## Platform terminology
15 
16This skill is agent-neutral:
17 
18- **Parent** is the agent that coordinates the run and owns shared state.
19- **Task tool** is the platform's delegation or sub-agent mechanism.
20- **`research` agent** is a delegated agent for focused source exploration and factual verification.
21…