om-auto-sec-report-pr
Auto Security Report — Single Unit
Analyze ONE unit of work — a PR (open or merged), a spec, or a branch diff — for
security issues. The analysis is intentionally paranoid: the OWASP Top 10
baseline first, then the non-obvious vectors a conventional review misses, then a
sweep for the same pattern elsewhere, and finally concrete Next steps — go
deeper runs of this same skill. The unit under analysis is read-only: this
skill never comments on, labels, claims, or pushes to the target. Its output is a
report — shipped as a docs-only PR through om-auto-create-pr, kept local, or
written as a fragment for the om-auto-sec-report driver.
A published report is a disclosure. Every run applies the disclosure policy in
references/agentic-setup.md: a finding that is exploitable in code already on
the base branch is withheld from anything published, and exploit detail
(payloads, reproduction steps, proof-of-concept code) never appears anywhere.