aot-security-audit

Audit a web codebase for security defects and return a prioritized, fixable report. Detect the stack, run the scanners, review the code against a focused checklist, triage by severity, then report. Apply fixes only after the user confirms.

This skill targets your stack: TypeScript/Node.js (Express, Fastify, NestJS, Next.js, Prisma, BullMQ) and C#/ASP.NET Core (EF Core, Dapper). Stack-specific remediation idioms live in the reference files. Read the one that matches before writing any fix.

What you produce

The deliverable is a single report. Build everything toward it:

• A summary: stack detected, scope scanned, finding counts by severity, top risks.
• A findings table: ID, severity icon, category, file:line, one-line issue, one-line fix.
• Per-finding detail with a remediation snippet in the codebase's own idiom.
• Scanner output summary: dependency vulnerabilities, SAST hits, secret hits.
• A remediation plan ordered by severity.

Scope before scanning

Determine three things from context. Confirm only what you cannot infer.