What problem does it solve? Security reviews of a codebase are slow and inconsistent: design-level questions (how identity, permissions, and secrets are handled) get mixed up with line-level pattern hunting, and grep hits turn into false-positive noise. This Skill performs a structured security review in one pass, producing verifiable, severity-calibrated findings with cited evidence. ## Core Features & Use Cases - Design-first review: Reconstructs identity/access, secrets handling, input validation, and third-party trust from actual enforcement points, recording defaults and bypass surfaces. - Disciplined code audit: Sweeps for in-tree credentials, injection sinks (command/SQL/path/template), crypto and randomness fitness, unsafe/FFI/dynamic code, and plugin or update trust — every grep hit is verified for reachability and mitigation before it becomes a finding. - Posture synthesis: Emits one summary finding stating the security design, the worst confirmed issue, what was swept clean, and what was not covered. - Use Case: Point it at a repository with a Sokrates _sokrates analysis and ask for a security audit; it writes _sokrates/reports/ai-insights/security-scan.json, validates it, and renders an interactive HTML explorer of the findings. ## Quick Start Run a security review of this repository using the existing Sokrates analysis and show me the worst confirmed findings and the overall security posture.
