security-posture-audit

The key words MUST, MUST NOT, SHOULD, SHOULD NOT and MAY in this skill are to be interpreted as described in BCP 14 (RFC 2119, RFC 8174) when, and only when, they appear in all capitals.

A defensive, read-only audit of a repository's security hygiene posture — the deterministic layer of the repo's trust family. It answers one question: which posture defects can a checklist prove from the tree, and how severe is each one in this repo's actual context?

The division of labor is the point: assets/audit_posture.py finds candidate defects deterministically (same tree in, same findings out), and the agent adjudicates each one with the code open — a flagged debug=True in a test fixture is INFO; the same line in a production entrypoint is HIGH. The tool never guesses context and you never grep by hand, because each side does only what it is reliable at: the tool finds the same candidates every run, and you judge each one in context.