What problem does it solve? Security audits often drown readers in false positives, unverified scanner output, and severity ratings with no demonstrated impact. This Skill structures a whole-codebase or feature-level security audit into four passes — context, attack surface, hunt, verify — so every finding names a reachable path, the control that should have stopped it, and a severity capped at demonstrated impact. ## Core Features & Use Cases - Four-pass audit workflow: Build context, enumerate the attack surface (including deployment config), hunt along reachable paths, then verify every candidate through explicit dismissal tests before reporting. - Threat modelling and triage: Model trust boundaries as concrete edges with STRIDE per edge, triage scanner output with falsifiable dismissal tests, and separate likelihood from impact when assigning severity. - Specialized workflows: Handle leaked credentials with a revoke-first response order, and turn repeated findings into tested semgrep rules with annotated test files. - Use Case: Before opening a reporting feature to customers, audit its Express routes, Python service, and deployment config to find an unauthenticated pickle deserialization sink, an IDOR on order routes, and a client-controlled role header — each reported with a file:line path and a fix. ## Quick Start Ask the agent to audit this repository or a named feature for security vulnerabilities and produce a severity-ranked report with confirmed, needs-validation, and rejected findings.
