security-audit

1# Security Audit
2 
3Performs a deep security audit using the Centinela (QA) agent.
4 
5## When to Use This Skill
6 
7- Before a release to verify security posture
8- After significant code changes that touch authentication, authorization, or data handling
9- Periodic security review of the codebase
10- When adding new dependencies or external integrations
11 
12## What This Skill Does
13 
141. Runs the SIGN IN checklist
152. Performs OWASP Top 10 systematic check (A01-A10)
163. Scans for hardcoded secrets, API keys, tokens, and connection strings
174. Audits dependencies for known CVEs
185. Checks smart contracts if Solidity is present (reentrancy, overflow, access control)
196. Runs Security Verification and Quality Verification checklists (TIME OUT)
207. Issues verdict and writes report to `docs/reviews/security-audit-{date}.md`
218. Prepares findings handoff to Dev agent
22 
23## How to Use
24 
25### Basic Usage
26 
27```
28/security-audit
29```
30 
31### Scoped Audit
32 
33```
34/security-audit src/auth/ src/api/
35```
36 
37## Example
38 
39**User**: `/security-audit src/payments/`
40 
41**Output**: A security audit report at `docs/reviews/security-audit-2026-02-23.md` with:
42- OWASP Top 10 findings organized by severity
43- Secrets scan results
44- Dependency vulnerability report
45- Verdict: APPROVED or CHANGES REQUIRED
46- Fix order recommendation for the Dev agent
47 
48## Tips
49 
50- If no scope is specified, the entire `src/` directory is audited
51- Critical findings trigger the Non-Normal emergency checklist
52…