What problem does it solve? Security issues like injection flaws, broken access control, exposed secrets, and cloud misconfigurations are easy to miss in manual code review, especially across polyglot stacks. This Skill runs a structured, repeatable security review that detects the project's language stack, applies deterministic vulnerability patterns, layers expert persona analysis, and produces a fingerprinted findings ledger plus an HTML report. ## Core Features & Use Cases - Three-pass scan architecture: Pass 1 applies deterministic rule-based patterns (injection, auth, IDOR, secrets, SSRF, XXE, misconfiguration); Pass 2 runs four focused persona reviews (Attacker, Data Protection, Access Control, Infrastructure); Pass 3 performs an open-ended adversarial analysis for business-logic and interaction flaws. - Stack-aware and scoped scanning: Detects .NET, TypeScript/Angular, Python, Java, Go, and VSTO projects, loads only matching language references, and supports scope flags like --changed, --pr, --full, --ci, and --area, with cache-aware incremental scans. - Compliance and reporting: Maps findings to SOC2, ISO 27001, NIST CSF, PCI-DSS, and HIPAA controls, generates a self-contained HTML report, maintains a reconciled security ledger, and can produce weekly security health summaries for managers. - Use Case: Before merging a pull request in an Angular + ASP.NET Core application, run a security review with --pr to catch a missing [Authorize] attribute, an IDOR in a controller route, and a secrets file not covered by .gitignore, then track the findings to closure in the security ledger. ## Quick Start Ask the assistant to run a security review of this repository for vulnerabilities and generate the findings report.
