/security - Security Audit Workflow

Use this skill to run a security audit workflow on sensitive code, prioritizing findings that can realistically become CRITICAL or HIGH impact.

When to Use

• The user asks for a security audit / vulnerability review ("is this secure?", "check for vulns").
• The code touches authn/authz, payments, secrets, PII, file upload/download, webhooks, admin actions, deserialization, or command execution.
• The user wants a scan + verification loop (audit findings → fixes → re-check).

When NOT to Use

• The user wants a general code review, debugging, refactor, or style improvements.
• The code is clearly non-sensitive (toy scripts, local-only utilities) and the user isn’t asking about security.

Defaults / Guardrails