oma-security

1# Security Scanning and Validation
2 
3## Scheduling
4 
5### Goal
6Run the selected security checks, retain their native evidence, independently validate candidates, and report findings and coverage on the recorded source or deployment identity.
7 
8### Intent signature
9- Requests to scan a repository, agent skill package, MCP component, or web test deployment for vulnerabilities.
10- Explicit Deepsec, Cisco Skill Scanner, Cisco MCP Scanner, Cisco AI Deep SAST, ARTEX, or Cloudflare security-audit-skill requests.
11- Security scan setup, scoped PR/diff analysis, finding triage/reproduction, scanner failures, or security CI gates.
12 
13### When to use
14- Scan application source or a source diff; inspect skill packages or MCP components.
15- Run a bounded runtime penetration test against a concrete authorized test deployment.
16- Validate scanner candidates, retain evidence, or configure an engine-specific CI gate.
17- Troubleshoot the selected scanner, credentials, coverage, matchers, quota, or resumable state.
18 
19### When NOT to use
20- Broad correctness, performance, accessibility, or quality review -> `oma-qa`.
21- External tool comparisons or research without execution -> `oma-search`.
22- Security architecture decisions -> `oma-architecture`.
23- Product-code remediation -> `oma-debug` or the owning backend/frontend/mobile/infrastructure skill.
24- A security question or a repository's existence alone does not request a scan.
25 
26### Expected inputs
27…