What problem does it solve? Security reviews of a full-stack repo and its live site are easy to do superficially: scanners get skipped, findings get reported without verification, and privacy posture is ignored. This Skill runs a disciplined, evidence-first sweep across dependencies, secrets, API routes, the AI chat layer, HTTP headers, CI/CD, and analytics, then reports verified findings without changing any code. ## Core Features & Use Cases - Dependency and secret scanning: Runs npm audit, secretlint, and full git-history greps for leaked keys, adapting when scanners like gitleaks or trivy are unavailable. - AI chat and API review: Checks the chat endpoint against the OWASP LLM Top 10, including prompt-injection defenses, rate-limit failure modes, output rendering, and PII retention. - Live verification: Confirms HTTP security headers against the actual production response and probes the chat endpoint with a small, bounded set of requests. - Use Case: Before a public launch, ask for a security audit to receive a private report ranking real risks (e.g., an unsalted IP hash in analytics logs) with concrete suggested fixes, plus a section crediting existing defenses. ## Quick Start Ask the assistant to run the security audit on this repository and live site, then review the private report of verified findings and suggested fixes.
