What problem does it solve? Security reviews are fragmented: secrets scanning, dependency CVE checks, and manual code review each live in separate tools, and no single pass connects them into one prioritized report. This Skill runs a comprehensive audit aligned with OWASP Top 10:2025 and consolidates every finding into one deduplicated, severity-ranked register. ## Core Features & Use Cases - Orchestrated multi-phase scan: Delegates secrets detection and dependency vulnerability checks to specialized skills, then adds deep static analysis across all ten OWASP categories via three concurrent review lenses. - Stack-specific analysis: Applies targeted checks for Python (bandit), Go (gosec, govulncheck), and TypeScript/JavaScript (npm audit), plus framework-specific rules for Django, Flask, FastAPI, Next.js, and Express. - Unified report with machine-readable output: Writes a severity-ranked report with a summary dashboard to .marvin/security/scan-report.md, including a JSON audit-report block for downstream tooling. - Use Case: Before a production release or acquisition due diligence, run a full audit that finds a SQL injection in a route handler, an unpinned dependency, and a hardcoded credential — all ranked against a shared severity rubric in one report. ## Quick Start Ask Claude to run a full security scan of this project and write the OWASP audit report.
