| name | security-audit |
| description | Review code, configuration, permissions, authentication, data handling, and dependencies for exploitable security weaknesses. Use for security reviews, threat analysis, trust boundaries, secrets, authorization, sandboxing, and dangerous command handling. |
| tools | ["file_read","file_grep","file_glob","shell_execute"] |
| triggers | ["security audit","vulnerability","threat model","authentication","authorization"] |
Security Audit
Report concrete attack paths and evidence, not generic checklists.
Procedure
- Establish assets, actors, entry points, trust boundaries, and deployment assumptions.
- Trace untrusted input from ingress to sensitive sinks.
- Review authentication, authorization, tenancy, and ownership separately.
- Inspect secret storage, logging, serialization, file paths, commands, and network destinations.
- Check fail-open behavior, race conditions, replay, confused-deputy paths, and privilege escalation.
- Validate dependency findings against the versions actually resolved by the project.
- Rank findings by exploitability and impact.
- For each finding, provide evidence, an attack scenario, and a specific remediation.
- Distinguish confirmed vulnerabilities from defense-in-depth recommendations.
Safety
- Do not run destructive exploitation against real data or external systems.
- Use local fixtures or isolated environments for proof of concept.
- Never expose secrets in logs or reports.
- Do not claim a vulnerability from a pattern match without tracing reachability.
Report
Order findings by severity.
Include file and line references, affected assumptions, and verification steps for the remediation.
