audit-security
Security Audit Skill
Degree of freedom: MIXED — Steps 0–4 judgment [HIGH freedom];
dependency and secret scans [LOW freedom — run exactly]. Never write
exploit PoCs.
Audit-and-fix exception. May fix inline. Plan-only burndown →
plan-security-audit. When fixing inline: patch the evidenced sink only, in place; unrelated weaknesses you notice go in the report as findings, not fixes. Add a test only where the repo already keeps security tests or the task asks. Auth behavior, RLS, secrets rotation, payments, and migrations stay STOP-and-confirm.
OWASP static review (injection, headers, deps). Session / route×gate /
getSession() → audit-auth-flows. Next.js 16: grep middleware.ts and
proxy.ts — a route gate can live in either file, and the proxy layer has its own bypass class.