What problem does it solve? Periodic deep security reviews are hard to run consistently: ad-hoc scans miss attack surfaces, produce noisy findings, and blur the line between real exploitable vulnerabilities and theoretical hardening gaps. This Skill provides a structured, read-only, phase-driven audit methodology that maps the full attack surface and reports only high-confidence, exploitable findings. ## Core Features & Use Cases - Phase-driven audit coverage: Fourteen phases spanning secrets archaeology, dependency supply chain, CI/CD pipelines, infrastructure, webhooks, LLM/prompt-injection risks, skill supply chain, OWASP Top 10, STRIDE threat modeling, and data classification. - Scoped and diff modes: Run full, comprehensive, or narrowly scoped audits (infra, code, owasp, supply-chain, skills, or a named domain), optionally constrained to files changed on the current branch. - Zero-noise confidence gating: Every finding must clear a confidence threshold, carry a concrete exploit scenario, and quote the motivating line of code; optional independent verification via a fresh-context agent filters false positives. - Use Case: Before launching a payments feature, invoke a scoped audit on the auth domain to trace webhook signature verification, session handling, and secrets exposure, then receive a severity-ranked findings report with exploit paths and remediations. ## Quick Start Ask the agent to run a full security audit of this repository and produce a severity-ranked findings report with exploit scenarios.
