Security review

Getting started

Pick a random starting point by running the bundled script. Prefix scripts/random-file.sh with this skill's base directory, the absolute path stated when the skill loads:

bash /path/to/skill/scripts/random-file.sh

Run it from the project root: the script samples whatever directory it runs in, and scripts/ belongs to this skill rather than the project.

The random entry point is intentional: it forces exploration of parts of the codebase that might otherwise be overlooked. The idea is to run this skill multiple times over the life of a project, each time pulling one thread from a different starting point.

Read the file the script returned. From there, follow one promising path -- a single thread of connections (imports, callers, callees, data flow) that looks like it could harbor a security issue. Go deep on that one path rather than trying to survey everything.

Reporting

Report exactly one finding -- the single most significant security issue you discovered along the path. Not two, not a list, just one. If nothing concerning was found, say so -- that's a valid outcome. Resist the temptation to pad the report with minor observations or informational notes.