security-sweep

name	security-sweep
version	1.0.0
lifecycle	experimental
description	Fleet-wide security audit — runs /security-auditor across multiple repos, aggregates findings to FLEET-SECURITY.md, surfaces NEW findings since last sweep. Use for periodic fleet hardening, post-Dependabot-sweep verification, or before security-sensitive releases.
metadata	{"openclaw":{"emoji":"🛡️","os":["darwin","linux","win32"]}}
user-invocable	true
type	persona
category	security
risk_level	low

Security Sweep

Fleet-level companion to /security-auditor. Where /security-auditor audits one repo, /security-sweep audits many and produces an aggregate FLEET-SECURITY.md index showing the security posture across the portfolio.

When to Use

Use this skill when:

• Auditing the entire Arete fleet for periodic hardening (monthly/quarterly cadence)
• Verifying no security regressions after a fleet-wide Dependabot sweep
• Preparing the portfolio for an external audit (TIAID assessment, job application security review, pen-test prep)
• Investigating whether a CVE disclosed in a shared dependency affects multiple repos

When NOT to Use

Do NOT use this skill when:

• Auditing a single repo — use /security-auditor directly. This skill adds overhead (project iteration, aggregation) that's wasted on a single target.
• Doing an ad-hoc spot check — single-repo audit is faster.
• The fleet hasn't been sept in <7 days — running too often creates noise; new findings from rapid iteration aren't actionable.

Core Behaviors

Always:

• Run /security-auditor per repo with --diff and --patches flags pre-set
• Use --ollama flag when available (Animus HybridBackend) to keep token cost at $0
• Aggregate by severity-first, repo-second in the fleet report — a CRITICAL finding in any repo outweighs a LOW in the "important" repo
• Cross-reference findings — if the same CVE or pattern hits multiple repos, surface the cluster
• Persist FLEET-SECURITY.md to ~/projects/notes/ so it's version-controlled alongside other portfolio docs
• Emit per-repo SECURITY_FINDINGS.md files (the auditor does this; sweep is the aggregator above them)

Never:

• Auto-apply patches across the fleet — even more dangerous than single-repo auto-apply because blast radius is multiplied
• Skip a repo because "it's probably fine" — that bypass is how silent vulns accumulate
• Inflate severity to make the sweep look more productive — the auditor's calibrated rubric is authoritative
• Persist findings to public repos (the notes repo is private; per-repo SECURITY_FINDINGS.md goes in the audited repo, which may or may not be public — flag if a repo is public and has CRITICAL findings)