What problem does it solve? Manual security reviews of large codebases miss attack classes and produce unverified findings. This Skill runs a structured, coverage-led vulnerability hunt that assigns attack classes to focused hunter agents, validates candidates against strict evidence rules, and tracks every reviewed unit in a ledger. ## Core Features & Use Cases - Coverage-led hunting waves: Splits a codebase into deterministic coverage units mapped to attack classes (injection, access control, memory safety, AI/LLM, cloud, client-side, and more) so no boundary is silently skipped. - Domain-specific hunting guides: Ships companion references for web/auth, client-side, cloud deployment, data isolation, desktop/mobile IPC, memory safety, and AI/agent trust boundaries. - Strict validation gates: Distinguishes confirmed findings (source trace plus bounded local proof) from needs_validation candidates, preventing speculative or overstated reports. - Use Case: Point it at a multi-tenant SaaS repository; it maps trust boundaries, dispatches hunters per subsystem, runs coverage critics to find gaps, and returns a deduplicated findings report with fingerprints, traces, and remediation guidance. ## Quick Start Ask the agent to run the security-audit skill against this repository and produce a validated findings report.
