What problem does it solve? Security reviews often miss real attack surfaces by focusing on checklists instead of trust boundaries, and AI/ML systems introduce new threat classes that traditional audits do not cover. This Skill provides a structured process for auditing changes, services, and deployments against concrete risk areas with severity-ranked findings. ## Core Features & Use Cases - Trust Boundary Analysis: Identify sensitive data, actors, external inputs, and trusted systems before scoping the audit. - Standards-Based Scoring: Score vulnerabilities with CVSS 4.0 (BTE nomenclature), check OWASP Top 10:2025 (including A10 exceptional conditions), and apply OWASP ASI01–ASI10 controls for agentic AI systems. - Zero Trust Verification: Validate mTLS with SPIFFE/SPIRE workload identity and SLSA Level 3 supply chain integrity for production builds. - Use Case: Before merging a change that adds a new API endpoint, run the audit to verify authentication, input validation, secret handling, and runtime exposure, then receive findings sorted by severity with reproducible evidence. ## Quick Start Use the security-audit skill to review this change for security risks and report findings by severity.
