Security

Find and reduce realistic abuse paths while keeping evidence, authority, and side effects explicit.

Compose with security-identity-access when identity or tenant-authorization boundaries are central. That companion owns identity-specific checks; this skill owns the shared investigation, safety, evidence, and reporting contract.

Choose The Mode And Authority

Mode	Use when	Authority
`security review`	Determine whether concrete code, configuration, or a change creates security-relevant weaknesses or unsafe exposures	Read-only: do not edit source or configuration or change external state
`threat model`	Map assets, boundaries, attacker goals, abuse paths, and mitigations	Read-only: do not edit the system or present scenarios as confirmed vulnerabilities
`secure implementation`	Design, implement, or remediate security-sensitive behavior	Mutate only the files or systems explicitly authorized by the request