What problem does it solve? Security reviews often produce vague warnings, unverified scanner output, or one-size-fits-all checklists that ignore how an application actually works. This Skill performs scoped, read-only security audits that trace untrusted input to privileged effects and return concrete, evidence-backed findings instead of speculation. ## Core Features & Use Cases - Trust Boundary Analysis: Traces untrusted input across frontend, API, IPC, plugin, file, database, shell, and external-service boundaries, inspecting enforcement where effects actually happen. - Evidence-Backed Findings: Each finding includes location, entrypoint-to-effect path, required conditions, severity reasoning, verification performed, and the smallest useful repair, separating demonstrated failures from unverified hypotheses. - Sensitive Data and Dependency Review: Checks secrets in source, config, logs, and bundles with redacted output, and resolves dependency findings against actually installed versions and current advisories. - Use Case: Before publishing a desktop app, ask for a security audit. The Skill reviews IPC permissions, secret handling, and release exposure, then reports blockers versus non-blocking hardening without modifying any code. ## Quick Start Ask the assistant to audit this project for security risks across its trust boundaries and report evidence-backed findings without changing any code.
