Security Audit

No em-dashes. Nothing this skill writes may contain an em-dash; use a comma, colon, or parentheses instead.

A focused security pass over a change. The job is narrow on purpose: find the vulnerabilities a senior security engineer would confidently raise in review, and stay silent about everything else. A review that flags twenty theoretical issues gets ignored; one that flags the two real ones gets acted on. Noise is the enemy, not thoroughness.

This skill layers on top of wstg-security-testing (/wstg). That skill carries the full OWASP WSTG map: 12 categories, ~109 test cases, detection payloads, and a diff-review mode. This skill adds the two things WSTG alone does not give you: the confidence gate and the false-positive precedents that keep the report credible. Use WSTG for coverage (what to look for and its ID), use this skill's gate to decide what actually gets reported.

It runs two ways:

• As Check 7 of /implementation-review, a parallel subagent whose brief pulls in this skill's content. Diff-scoped, fast.
• Standalone (/security-audit), a deliberate pass on demand.

The one rule that matters

Only report a finding you can attach a concrete exploit path to, and only when you are over 80% confident it is actually exploitable. Everything else here serves that rule.