What problem does it solve? Pentest reports and CVE lists often contain unverified hypotheses and inflated severities, leading teams to over-engineer fixes or chase non-issues. This Skill maps each finding to real code with file:line evidence, separates confirmed risks from noise, and produces a realistic fix backlog. ## Core Features & Use Cases - Finding Verification: Classifies each reported issue as confirmed, partially confirmed, or not confirmed with concrete file:line evidence. - Severity Recalibration: Recomputes severity based on the project's actual runtime context (SQL-first architecture, reverse proxy, launch constraints) instead of copying external report ratings. - Prioritized Remediation Scope: Outputs a minimal safe P0/P1 fix set, a deferred P2 set, and an explicit list of risky changes that could break runtime. - Use Case: After receiving an external pentest report for your API, run this Skill to verify which injection, XSS, and auth bypass findings actually exist in the codebase before committing engineering time to fixes. ## Quick Start Ask the agent to validate the security audit report against the codebase and produce a findings matrix with adjusted severities and a P0/P1 remediation scope.
