What problem does it solve? Running a whole-repository security audit is unbounded and expensive, and raw scanner output is full of false positives. This Skill imposes a fixed, budget-aware audit order — scoped discovery, adversarial CWE-specific verification, deduplication, triage, and a controlled remediation lifecycle — so findings are evidence-backed and the report honestly states what was and was not covered. ## Core Features & Use Cases - Two-pass audit workflow: open-ended discovery for recall, then a CWE-specific second pass that demands proof of reachability and absence of mitigations before any candidate survives. - Shared severity and triage doctrine: a canonical severity/confidence rubric, KEV → EPSS → CVSS prioritization, suppression ordering, and anti-noise guardrails that keep reports credible. - Vulnerability lifecycle management: intake records, ownership assignment, controlled remediation with independent review, and p50/p90 patch-gap metrics via ready-to-use templates. - Use Case: Point the Skill at a service and its data layer, and it will scope the audit, preflight tools like opengrep, osv-scanner, gitleaks, and trivy, run the two-pass review, and produce a severity-ordered report with a tool coverage table and open questions. ## Quick Start Run a security audit of the authentication module on the current branch and produce a findings report with severity, evidence, and remediation recommendations.
