OpenAlgo security audit

Run monthly (or twice monthly), and additionally before any release and after any dependency bump.

uv run --with openpyxl python .claude/skills/security-audit/audit.py

Writes tmp/security-audits/<YYYY-MM>/security_audit_<date>_<time>.xlsx. tmp/ is gitignored and holds reports only — the script keeps its own scratch files in the OS temp dir. Exit code is 0 when no CRITICAL/HIGH check is failing, 1 otherwise, so it drops into CI unchanged.

The script is read-only. It never rotates a key, edits config, or touches the database, and the report never contains a secret value — only pass/fail, a sha256: fingerprint, and a remediation pointer. That means the xlsx is safe to share with someone helping you triage.