What problem does it solve? Security reviews of a codebase are slow, inconsistent, and often miss infrastructure-level risks like leaked secrets in git history, unsafe CI/CD workflows, or LLM-specific attack vectors. This Skill runs a structured, multi-phase security audit that covers both application code and the surrounding infrastructure, with confidence-gated reporting to reduce noise. ## Core Features & Use Cases - Infrastructure-first audit phases: secrets archaeology in git history, dependency supply chain analysis, CI/CD pipeline security, Docker/IaC review, webhook signature verification, LLM/AI security checks, and skill supply chain scanning. - Two audit modes: a daily zero-noise mode with an 8/10 confidence gate, and a comprehensive monthly deep scan with a 2/10 reporting bar, plus trend tracking across runs. - OWASP Top 10, STRIDE threat modeling, and data classification: systematic coverage of access control, injection, SSRF, and per-component threat evaluation. - Use Case: Before a release, ask for a security audit of your repository; the Skill detects your stack, scans for leaked credentials and vulnerable dependencies, reviews GitHub Actions workflows, and produces a severity-ranked report with false-positive filtering. ## Quick Start Ask the agent to run a security audit of this repository and report only high-confidence vulnerabilities with severity ratings.
