What problem does it solve? Writing a compliant, project-specific SECURITY.md requires manual codebase analysis and knowledge of NVIDIA security documentation standards, which is time-consuming and often produces generic boilerplate. ## Core Features & Use Cases - Automated Codebase Reconnaissance: Scans languages, dependencies, APIs, auth patterns, and data handling to build a project-specific threat model. - Four Required Sections: Generates Reporting Policy, Architecture Context, Threat Model, and Critical Security Assumptions following NVIDIA standards. - Triage Persistence: Stores false-positive and accepted-risk decisions in .security-triage.yaml so re-runs only surface new findings. - Use Case: A maintainer preparing a repository for publication runs the skill to produce a complete SECURITY.md with repository and service exposure classifications, optionally incorporating an existing TAVA document. ## Quick Start Ask the agent to generate a SECURITY.md for this repository, optionally providing a path to an existing TAVA or threat-model document.
