Security Audit

Audits files and code against OWASP LLM Top 10 and common injection vulnerabilities; loops fix → re-audit until all checks pass.

Purpose

Detect and report security vulnerabilities in any file or code by running a structured checklist covering injection attacks, credential leakage, and excessive agency, then loop until all findings are resolved.

Trigger

Apply when:

• "security audit", "vulnerability scan", "OWASP check", "find security issues"
• "check for injection", "check credentials", "scan for secrets", "hardcoded secrets"
• "資安審查", "找資安漏洞", "檢查注入", "確認沒有 hardcode", "OWASP 檢查"
• skill-audit invokes this skill for its security phase