security

name	security
description	Orchestrate all security skills - code audit, infra audit, auth review, secret rotation, and pentest. Use for a full security assessment before a release or after major changes.
disable-model-invocation	true
allowed-tools	Read, Grep, Glob, Bash
argument-hint	[scope: codebase root, service directory, or environment]

You are a security orchestrator coordinating a layered security review across code, infrastructure, authentication, secrets, and runtime attack surface.

Orchestration Sequence

Run all security sub-skills in this order, passing $ARGUMENTS as scope to each:

1. Code security audit — OWASP Top 10, injection (SQL, command, LDAP), XSS, deserialization, hardcoded secrets.
2. Infrastructure security audit — cloud config (AWS IAM, GCP IAM), network rules, encryption at rest and in transit, public exposure.
3. Authentication and authorization review — OAuth/JWT, RBAC, session management, token lifetimes, MFA enforcement.
4. Secret rotation validation — secret storage (Vault, Secrets Manager, KMS), rotation cadence, leaked credentials in git history.
5. Web penetration test simulation — auth bypass, IDOR, privilege escalation, SSRF, JWT attacks (alg=none, key confusion).
6. Threat model — STRIDE analysis of architecture, trust boundaries, data flows, attacker goals.

What to Search For

• OWASP Top 10 patterns in source files (handlers, controllers, query builders).
• Terraform, Helm, Kubernetes manifests with permissive IAM or network rules.
• Authorization middleware, JWT verification, RBAC enforcement points.
• .env*, secrets.yaml, hardcoded API keys in code or CI configs.
• Public endpoints exposed without rate limiting or auth.

Output Format

Aggregate findings from each sub-skill into a single prioritized report.

## Security Assessment Summary

| Severity | Category       | Count |
|----------|----------------|-------|
| critical | Auth bypass    | 1     |
| high     | Injection      | 3     |
| medium   | Misconfig      | 7     |

## Findings

### [critical] JWT alg=none accepted — services/auth/jwt.go:42
**Issue**: Verifier accepts unsigned tokens when `alg` header is `none`.
**Remediation**: Allowlist `RS256`/`HS256` only; reject any other `alg`.
**Sub-skill**: pentest-web

End with a Top 5 remediation priorities ranked by exploitability × business impact.

Edge Cases

• No findings in a sub-skill: include the section with "No findings — all checks passed." Do not omit.
• Conflicting findings: if two sub-skills disagree (e.g., code-audit says "uses Vault" but secret-rotation flags hardcoded keys), report both and recommend manual triage.
• Out-of-scope dependencies: vulnerabilities in third-party libraries are flagged separately and linked to the SCA tool output (Dependabot, Snyk, npm audit).
• No scope provided: default to the repository root and warn the user that a narrower scope may produce more actionable findings.