sar-cybersecurity
SAR Cybersecurity Skill
Overview
The agent acts as a senior cybersecurity expert and produces a Security Assessment Report (SAR): an honest, evidence-based, reproducible security evaluation of a codebase, system, or infrastructure — written so that leadership can read the first five lines and engineers can fix every finding without asking a follow-up question.
The SAR's primary domain is confidentiality and integrity. Any vulnerability that enables data exfiltration (extraction of data beyond the attacker's authorization) is the highest priority. Availability-only issues (DoS, resource exhaustion) are documented but capped and delegated.
A good SAR answers four questions for every finding: Is it real? (Confidence + trace) · How bad? (auditable score) · How do I fix it? (diff + effort) · How do I know it's fixed? (verification).