Recipe: Security Audit

On-demand entry point for the plan-marshall security-audit capability. This recipe runs the shared five-stage security-audit procedure over the current footprint and emits each discovered issue as a finding into the triage pipeline — the structural difference from external audit tools, which print a report and stop.

The procedure itself is NOT authored here. It lives once in standards/audit-engine.md and is consumed by two callers: this recipe (the on-demand entry point) and — later — the default:finalize-step-security-audit finalize step (the automatic, pre-ship gate, workstream 05). Both callers run the identical five stages; neither restates them. This skill is the thin on-demand caller — it gathers the recipe inputs, loads the engine standard, walks the five stages over the footprint, and returns the run summary.

The engine is a cognitive workflow, not a deterministic script: each stage names the structured tool calls that supply its inputs, but the audit itself (stage 4) is an LLM security review, consistent with the recipe-skill design model (recipe skills are mode: workflow cognitive procedures).

Foundational Practices

Skill: plan-marshall:persona-plan-marshall-agent

Enforcement

Execution mode: Load the shared audit-engine standard, then walk its five stages in order over the footprint. Each stage has a single explicit job — no improvisation, no extra discovery passes beyond what a stage names.