Security Fitness Review

Analyze the codebase (or specified files/modules) for security fitness.

Reference: Fundamentals of Software Security — see also Fundamentals of Privacy and Compliance and Fundamentals

Domain Knowledge

• references/rubric.md is the scoring source: severity definitions, 1-10 anchors per dimension, the N/A rule, and the overall-score formula. It is short; read it first so scores are repeatable across runs.
• references/checklist.md is what to check during each workflow step, including section 9 (CI/CD and containers) with ready-made grep patterns.
• references/wisdom.md is optional background, auto-synced from the two articles above. It has no rubric. Grep it by heading for a specific question (grep -n '^##' references/wisdom.md); never read it whole, it is about 15k tokens.

Configuration

Invoke the resolver CLI to obtain the effective security.confidenceThreshold. Never load fitness-config.json directly.

python3 "${CLAUDE_SKILL_DIR}/../../scripts/fitness-config.py" show --path <target>