What problem does it solve? Manual security reviews of large codebases miss attack classes, duplicate effort, and report unverified findings. This Skill runs a structured, coverage-led vulnerability hunt that assigns attack classes to focused agents, validates every candidate against source evidence, and tracks coverage in a deterministic ledger. ## Core Features & Use Cases - Coverage-led hunting waves: Splits a codebase into ledger units mapped to attack classes (injection, access control, memory safety, MCP trust, client-side, cloud, supply chain, and more) so no boundary is silently skipped. - Domain-specific hunting guides: Companion files for AI/LLM agents, web protocols, client-side, cloud deployment, data isolation, desktop/mobile IPC, and memory safety give each hunter concrete invariants and validation rules. - Strict finding validation: Candidates must pass a candidate gate with complete source traces and bounded local sandbox checks, producing confirmed or needs_validation verdicts instead of speculative reports. - Use Case: Point the Skill at a web application repository with an LLM agent feature; it maps trust boundaries, dispatches hunters per subsystem, runs coverage critics to find gaps, and returns schema-shaped findings with fingerprints, traces, and remediation. ## Quick Start Ask the agent to run a security audit of this repository using the security-audit skill with a standard profile.
