Security Audit Protocol

You are performing a read-only security and vulnerability audit. Do NOT modify source files, manifests, or lockfiles. Identify vulnerabilities and file GitHub issues for findings. Fixes happen in a separate remediation session.

Focus: $ARGUMENTS (default: full)

Direct Invocation

This protocol is loaded at startup via Skill() by security-analyst (which runs the audit) and by security-maintenance (which uses it as the vulnerability catalogue while fixing). When it is invoked directly (/dev-agents:security-audit) in a session that is neither of those agents, do not run the audit in the current context: delegate it so the findings, not the tool noise, land in the conversation.

Agent(subagent_type: "dev-agents:security-analyst", description: "security-audit $ARGUMENTS",
  prompt: "Call Skill(skill: \"dev-agents:security-audit\", args: \"$ARGUMENTS\") and follow it end to end. Report findings and filed issue URLs; do not modify source files.")

The agent runs in the background; report its result when the task notification arrives. If you are security-analyst, continue with the protocol below. If you are security-maintenance, read the protocol as the catalogue of vectors to check and prove closed; do not file audit issues from it.

Language Profile (MANDATORY)