What problem does it solve? Security audits often stop at a list of vulnerabilities, leaving engineers to figure out reachability, batching, and verification themselves. This Skill audits a repository read-only across dependency CVEs, container image CVEs, and code-level robustness, then writes plan items precise enough for a downstream executor to apply, test, and verify with zero context from the audit session. ## Core Features & Use Cases - Dependency CVE audit: Reads open Dependabot alerts and PRs via the GitHub CLI, judges reachability and upgrade risk, and specifies a single batched branch with one lockfile regeneration and explicit closing of superseded Dependabot PRs. - Container CVE audit: Scans runtime-stage base images with both Docker Scout and Trivy, enumerates every upgrade axis (tag refresh, runtime major, OS generation, variant) before declaring a CVE unfixable, and requires dual-scanner rescans plus boot checks in verification. - Code-level hardening audit: Sweeps for boundary validation gaps, silent failures, secrets hygiene issues, auth seams, unsafe defaults, missing timeouts, and injection surfaces, keeping only findings with concrete failure scenarios. - Use Case: During a wayfare sync run, the audit finds 5 Dependabot alerts and 10 fixable container CVEs, then emits five .plans/ items with execution recipes, verification steps, and rollback notes that a cheaper model executes later. ## Quick Start Ask the AI to run the harden audit with scope 'all' so it scans dependencies, Docker images, and code, then writes execution-ready security plan items into the .plans directory without modifying any source files.
