setup-security-workspace
Setup Security Workspace
Run once per checkout before the first assessment. Invocation authorizes routine tool, package, runtime, and local-service installation needed by this skill. Install the full profile by default; use a smaller profile only when the user explicitly asks. Record progress in security-artifacts/setup.md so setup is resumable and every installed component is removable later.
1. Inspect
Read README.md and AGENTS.md. Identify the OS, architecture, agent host, available package managers and privileges, then enumerate every tool under .agents/skills/tools/ plus its required runtime, data, service, and MCP integration. Preserve compatible existing installations rather than upgrading them merely because a newer release exists.
Classify each component as ready, missing, manual, or failed. For every component, record: component, ownership (pre-existing, setup-owned, or manual), official source, install method and command, discovered version, paths or service identity, status, evidence, and exact uninstall or cleanup command. Complete when every full-profile component is classified and has an official source.
2. Install
For each missing component, read official tool sources, then consult its current official installation instructions. Prefer the operating system's supported package manager; otherwise use the vendor's supported installer, release, or runtime manager. Install automatically, in dependency order, and verify each executable or service immediately. Write its ownership and removal instructions to the ledger before continuing.
Do not pause for routine installation confirmation. Use already-available privilege safely. When elevation, license acceptance, GUI interaction, driver approval, or device connection cannot be automated, complete every safe precursor and request one exact user action.
On failure, preserve the command, output, and exit status, then diagnose. Retry only when the source, method, environment, or hypothesis changes. An unchanged repeated failure becomes manual-gap with its impact and one exact next step. This step is complete when every component is verified or has an unavoidable, precisely documented user action; setup is not ready until all full-profile components verify.