Security Audit

No em-dashes. Nothing this skill writes may contain an em-dash; use a comma, colon, or parentheses instead.

A focused security pass over a change. The job is narrow on purpose: find the vulnerabilities a senior security engineer would confidently raise in review, and stay silent about everything else. A review that flags twenty theoretical issues gets ignored; one that flags the two real ones gets acted on. Noise is the enemy, not thoroughness.

This skill layers on top of wstg-security-testing (/wstg). That skill carries the full OWASP WSTG map: 12 categories, ~109 test cases, detection payloads, and a diff-review mode. This skill adds the two things WSTG alone does not give you: the confidence gate and the false-positive precedents that keep the report credible. Use WSTG for coverage (what to look for and its ID), use this skill's gate to decide what actually gets reported.

It runs two ways:

• As Check 7 of /implementation-review, a parallel subagent whose brief pulls in this skill's content. Diff-scoped, fast.
• Standalone (/security-audit), a deliberate pass on demand.

When this is the wrong skill

This skill reviews a change. It does not audit a codebase. If the ask is repo-wide ("audit this project", "is my app secure", "find every IDOR", "auditoria de segurança"), stop and run /wstg mode 2 instead, which carries the systematic protocol in reference/CODEBASE-AUDIT.md.