What problem does it solve? Security reviews are often skipped because they require deep expertise and manual effort across code, infrastructure, and developer machines. This Skill automates evidence gathering against the OWASP Top 10:2025 checklist and recent 2025-2026 incident patterns, then turns findings into a scored, prioritized remediation report. ## Core Features & Use Cases - Stack-agnostic scanning: Detects vulnerabilities in any repository (code, Docker, IaC, CI config) without needing the project's toolchain installed, plus an optional local credential-hygiene scan of the developer's machine. - Interview-driven verification: Narrows follow-up questions based on scan evidence so a human confirms what static scanning cannot judge, such as access-control logic and operational controls. - Scored remediation report: Produces a markdown report with a 0-100 posture score, letter grade, prioritized fixes, and real-incident rationale for each finding. - Use Case: Before a release, run the audit on your repo to catch hardcoded secrets, missing lockfiles, and misconfigured cloud resources, then file failing categories as Notion tasks for tracking. ## Quick Start Ask the AI to run a security audit on the current repository and generate a scored remediation report.
