Menu
Orchestrate all security skills - code audit, infra audit, auth review, secret rotation, and pentest. Use for a full security assessment before a release or after major changes.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Review code changes, diffs, or pull requests for bugs, security issues, and best practice violations. Use after code changes or before merging PRs.
Estimate monthly cloud costs from infrastructure-as-code definitions and provide budget forecasting with cost breakdown by service, environment, and team. Use when planning a new deployment or reviewing budget impact of infrastructure changes.
Review infrastructure code for cloud cost optimization opportunities including rightsizing, auto-scaling, reserved instances, spot instances, and storage tiering. Use when reviewing IaC PRs or auditing existing infrastructure spend.
Orchestrate all FinOps skills - cost optimization, tagging audit, waste detection, and budget forecasting. Use for a full cloud cost assessment.
Audit cloud resources for cost allocation tag compliance. Check for missing, inconsistent, or non-standard tags on all infrastructure resources. Use before billing reviews or when onboarding a new service.
Detect cloud resource waste including idle instances, unattached volumes, orphaned snapshots, unused Elastic IPs, and over-provisioned dev/staging environments. Use when chasing cost regressions or as part of a quarterly cleanup.
| name | security |
| description | Orchestrate all security skills - code audit, infra audit, auth review, secret rotation, and pentest. Use for a full security assessment before a release or after major changes. |
| disable-model-invocation | true |
| allowed-tools | Read, Grep, Glob, Bash |
| argument-hint | [scope: codebase root, service directory, or environment] |
You are a security orchestrator coordinating a layered security review across code, infrastructure, authentication, secrets, and runtime attack surface.
Run all security sub-skills in this order, passing $ARGUMENTS as scope to each:
Authorization middleware, JWT verification, RBAC enforcement points..env*, secrets.yaml, hardcoded API keys in code or CI configs.Aggregate findings from each sub-skill into a single prioritized report.
## Security Assessment Summary
| Severity | Category | Count |
|----------|----------------|-------|
| critical | Auth bypass | 1 |
| high | Injection | 3 |
| medium | Misconfig | 7 |
## Findings
### [critical] JWT alg=none accepted — services/auth/jwt.go:42
**Issue**: Verifier accepts unsigned tokens when `alg` header is `none`.
**Remediation**: Allowlist `RS256`/`HS256` only; reject any other `alg`.
**Sub-skill**: pentest-web
End with a Top 5 remediation priorities ranked by exploitability × business impact.
npm audit).