What problem does it solve? Security reviews often devolve into generic checklists or noisy scanner output that misses real, exploitable weaknesses. This Skill provides a structured, attacker-minded audit workflow that threat-models the system, traces untrusted data to dangerous sinks, verifies findings safely, and reports them with severity, confidence, and concrete fixes. ## Core Features & Use Cases - Threat modeling and coverage planning: Map architecture, data flows, trust boundaries, and attacker profiles, then derive review coverage from versioned baselines like OWASP ASVS, WSTG, and NIST SSDF. - Broad vulnerability review: Covers injection, authentication, authorization, business logic, APIs, secrets, cryptography, SSRF, deserialization, supply chain, configuration, logging, AI/agentic systems, and resource exhaustion. - Safe verification and evidence grading: Establishes findings with least-invasive authorized evidence and labels confidence as Confirmed, High, Medium, or Low, separating real vulnerabilities from scanner leads. - Severity, remediation, and reporting: Records technical severity, remediation priority, and CWE mapping separately, supports review-only and review-and-remediate modes, and enforces strict authorization guardrails. - Use Case: Ask for a security audit of a web API change before release; the Skill threat-models the endpoints, traces input to sinks, checks authorization policies, and returns a prioritized findings report with fixes and regression test guidance. ## Quick Start Ask the assistant to audit the current workspace for security vulnerabilities and report prioritized findings with severity and fixes.
