security-audit

Invoke the security-audit skill against your repository. It first detects your stack from files like package.json or go.mod, then systematically sweeps all route handlers, database tables, frontend privilege gates, and deploy configs for five vulnerability classes, reporting only evidence-backed findings.

This audit covers five classes: missing tenant or owner isolation in queries, privilege gates enforced only in the browser, IDOR on object references, hardcoded or git-history secrets including insecure defaults, and unsanitized input leading to XSS or HTML injection.

Yes, the audit is stack-adaptive. It detects the project's language and framework from manifests like go.mod, requirements.txt, Gemfile, or pom.xml, then translates each vulnerability class into the equivalent checks for that stack, such as RLS policies for Supabase or middleware scopes for ORMs.

Every finding requires file:line evidence plus a confidence rating from CONFIRMED down to SPECULATIVE. The skill explicitly excludes public-by-design resources, publishable API keys, framework auto-escaping, doc examples, and middleware-covered routes, and declares inapplicable categories as N/A.

Use specialized skills when you need depth in a single area: authorization-audit for authz and IDOR, input-trust-audit for input handling, api-abuse-audit for endpoint surfaces, or data-integrity-audit for database constraints. The security-audit skill is the umbrella that produces the consolidated final report.