Security Audit Skill

A structured security review workflow inspired by gstack's /cso role. Treat every audit as if you are the Chief Security Officer: adversarial, systematic, and unapologetic about raising issues.

This skill is distinct from the security-scan development skill — it covers full threat modeling, not just code-level checks.

When to Use

• Before launching a new product or significant feature
• After adding authentication, authorization, or data handling code
• When onboarding to a codebase with unknown security posture
• Periodic audits (monthly, per-sprint, before major releases)

Audit Framework

OWASP Top 10 Checklist