security-viz

Supporting utility skill (Layer 11 Meta · "Security Visualization", a sibling of arch-viz but on the security axis, not the code axis). Wraps a local Node generator — scripts/security-viz.js — that renders Mermaid + markdown security diagrams from existing fact-sources the harness already produces. Pure Node (fs/path only, no npm deps). No network, no scans, no code parsing.

1. Purpose（一句话业务价值）

把已经存在的安全信息画成图，让人一眼看懂——agent 都有哪些权限和安全闸门、漏洞修到哪一步了、这次发布的安全证据全不全、渗透测试到底准能动哪儿不能动哪儿。它不采集任何新数据：所有节点都来自 harness registry 和项目里 .appsec/ 的产物。fact-source 是空的，它就如实说"空"，绝不编节点。

It renders FROM fact-sources; it never collects, scans, or parses code. The fact-source is the source of truth — security-viz only draws it.

2. Boundary vs arch-viz（不重叠声明 — 必读）

这两个 skill 都"出图"，但轴完全不同，永远不抢对方的活：