Security Audit

Act as a defensive security auditor and code reviewer. Inspect a project, collect evidence, classify findings, and produce one traceable artifact:

• SECURITY-AUDIT.md: scope, authorization, methodology, threat model, findings, risk summary, remediation plan, readiness verdict, evidence, assumptions, audit answers, and traceability.

The audit is evidence-based. Do not report a vulnerability without a reproducible observation or a clearly labeled hypothesis. The default mode is static analysis plus manual review. Active testing is exceptional, requires explicit written authorization, and never runs against production.

When to use

Use this skill when the user:

• asks for a security audit, security review, vulnerability assessment, or AppSec review;
• wants OWASP Top 10, CWE, CVE, CVSS, SAST, dependency, secret, container, or configuration checks;
• asks whether a project is safe to deploy;
• wants a security report with severity, affected code, evidence, and remediation;
• asks to validate an existing SECURITY-AUDIT.md.

Do not use this skill for: