security-posture-audit

A defensive, read-only audit of a repository's security hygiene posture — the deterministic layer of the repo's trust family. It answers one question: which posture defects can a checklist prove from the tree, and how severe is each one in this repo's actual context?

The division of labor is the point: assets/audit_posture.py finds candidate defects deterministically (same tree in, same findings out), and the agent adjudicates each one with the code open — a flagged debug=True in a test fixture is INFO; the same line in a production entrypoint is HIGH. The tool never guesses context; you never grep by hand.

Locating this skill's helpers (do this first). The steps below run bundled scripts. You execute from the target repo, not from this skill's directory, so a path written relative to this skill will not resolve. Resolve the base directory once and use it everywhere — including in any subagent prompt, which must receive the literal absolute path, never a relative form: