What problem does it solve? Manual security reviews are inconsistent and often miss business-logic flaws, injection paths, and access-control bugs that automated scanners alone cannot catch. This Skill provides a structured, phased audit protocol that combines automated baseline scanning with deep white-box review, so vulnerabilities are found, prioritized by business risk, and reported with actionable remediation steps. ## Core Features & Use Cases - Phased Audit Protocol: Four phases covering scope and trust modeling, automated baseline scanning (secrets, dangerous sinks, dependency CVEs), manual white-box review (authN/authZ, injection, crypto, race conditions), and formal verification for crown-jewel components. - Domain-Specific Checklists: Built-in threat models and checklists for Web/API applications, embedded and safety-critical C/C++ systems, and Web3 smart contracts (reentrancy, oracle manipulation, MEV). - Automated Tool Runner: A script that detects the project stack and runs bandit (Python), slither (Solidity), cargo clippy/audit (Rust), govulncheck (Go), or npm/yarn/pnpm audit (JavaScript). - Use Case: Before shipping a new REST API, run the audit to map the attack surface, scan dependencies for known CVEs, trace user input from source to sink for injection flaws, and produce a severity-ranked report with proof-of-concept steps and fixes. ## Quick Start Ask the AI to run a security audit on your project directory, starting with the trust model and automated baseline scan before reviewing each component.
