audit-report

Turns a findings list into a document someone will actually read. This skill owns report production only: it does not find anything. The findings come from /wstg mode 2 (see its reference/CODEBASE-AUDIT.md), from /security-audit on a diff, or from any other review.

The contract is a JSON file. You write the JSON, the bundled script renders the PDF. That split is the point: re-running the report after a fix means editing JSON and re-running one command, not regenerating a document by hand.

Protocol