Security Audit Skill

Degree of freedom: MIXED — Steps 0–4 judgment [HIGH freedom]; dependency and secret scans [LOW freedom — run exactly]. Never write exploit PoCs.

Audit-and-fix exception. May fix inline. Plan-only burndown → plan-security-audit.

OWASP static review (injection, headers, deps). Session / route×gate / getSession() → audit-auth-flows. Next.js 16: grep middleware.ts and proxy.ts (the Aug-2026 security line included a proxy-bypass class).

How to reason

1. Observe — quote the sink or missing check (file:line)
2. Interpret — can untrusted input reach a query, HTML, or object-id?
3. Classify — injection / IDOR / secret / header / dep-CVE / hand-off
4. Severity — exploitable data access or hardcoded secret = Critical