harden: find the exploit path, not a pile of scary words

Security work is a risk-reduction decision made from evidence. It starts with assets, actors, trust boundaries, and attacker goals; scanners and checklists then help inspect the paths that matter. A clean tool output is not proof of safety, and a CVE identifier is not proof that an application is exploitable.

Purpose and scope

Use this skill to assess or change a system that handles identities, money, personal or confidential data, administrative authority, external input, untrusted files, third-party dependencies, build/deploy credentials, or an agent that can retrieve data or invoke tools.

The result is one of: