Menu
Three-layer security audit: access controls, audit trail, and code scanning. Use before shipping anything that touches auth, payments, user data, or external integrations. Combines OWASP Top 10, STRIDE threat modeling, and secrets archaeology.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Collaborative alignment discussion with the human. Use after /convergence-research (or directly for smaller features). Produces a ~200-line design document. The human makes all design decisions — the agent surfaces assumptions, patterns, and open questions.
Define and codify project-level architectural invariants, scope boundaries, and non-negotiable rules. Produces ARCHITECTURE.md — the persistent constraint file that shapes every AI interaction. Use once per project or when architectural drift is detected.
Execute outline phases with verification checkpoints. Use after /convergence-outline approval. Works through each phase sequentially: write tests first, implement, verify, commit. Stops and asks the human if 3+ fix attempts fail on any phase.
Code review on the actual diff against the base branch. Use after implementation or when asked to review a PR. Two-stage review: correctness (did we build the right thing?) then quality (did we build it right?). Defaults to NEEDS WORK until evidence proves readiness.
Architecture analysis with quantified quality gates. Use for codebase health checks, onboarding, or before major refactors. Detects layer violations, scores callbacks, finds god objects via churn x complexity, and checks code quality thresholds.
Capture what was learned after solving a bug or completing a feature. Reads recent git context, drafts a structured learning, and asks the human to correct or approve. Writes searchable artifacts to docs/convergence/learnings/.
| name | convergence-security |
| description | Three-layer security audit: access controls, audit trail, and code scanning. Use before shipping anything that touches auth, payments, user data, or external integrations. Combines OWASP Top 10, STRIDE threat modeling, and secrets archaeology. |
Think carefully and step-by-step before responding — missed vulnerabilities are harder to find than to exploit, so reason deeply at each layer.
Three-layer security check: what can the agent access, what did it do, and is the output secure.
IF YOU WOULDN'T GIVE IT TO AN INTERN, DON'T GIVE IT TO YOUR AGENT.
Check that credentials and permissions are scoped to minimum needed.
.claude/settings.json and any MCP configsNODE_OPTIONS, LD_PRELOAD, DYLD_INSERT_LIBRARIESVerify that agent actions are logged and reviewable.
~/.claude/projects/)Scan the codebase for vulnerabilities.
| Category | What to Check |
|---|---|
| A01: Broken Access Control | Missing auth checks on endpoints, IDOR (accessing other users' resources by changing IDs) |
| A02: Cryptographic Failures | Hardcoded secrets, weak hashing, missing encryption for sensitive data |
| A03: Injection | SQL injection (raw SQL, string interpolation), command injection (unsanitized shell args), template injection |
| A04: Insecure Design | Missing rate limiting, no abuse prevention, overly broad APIs |
| A05: Security Misconfiguration | Debug mode in production, default credentials, verbose error messages |
| A06: Vulnerable Components | Dependencies with known CVEs. Run npm audit, bundle audit, or equivalent |
| A07: Auth Failures | Weak password policy, missing MFA, session fixation |
| A08: Data Integrity | Missing input validation, unsigned data, unverified downloads |
| A09: Logging Failures | Security events not logged, no alerting on suspicious activity |
| A10: SSRF | User-supplied URLs fetched server-side without validation |
Search git history for leaked credentials:
git log -p --all | grep -iE "(api_key|secret|password|token|AKIA|sk-|ghp_|xoxb-)" | head -50
Check for:
.env files tracked by git (should be in .gitignore)For new attack surfaces introduced by the change:
| Threat | Question |
|---|---|
| Spoofing | Can someone fake an identity to access this? |
| Tampering | Can data be modified in transit or at rest? |
| Repudiation | Can someone deny they performed an action? |
| Information Disclosure | Can sensitive data leak through this path? |
| Denial of Service | Can this be used to crash or exhaust resources? |
| Elevation of Privilege | Can this bypass authorization? |
postinstall scripts in production dependenciesWrite findings to docs/convergence/security/YYYY-MM-DD-audit.md.
Categorize findings:
Each finding must include: file path, line number (if applicable), description, and specific remediation steps.
| Bad | Why | Do Instead |
|---|---|---|
| "It's an internal tool" | Internal tools get compromised too | Audit everything |
| Skipping git history search | Leaked secrets persist in history even after deletion | Always search history |
| "Dependencies are fine" | Supply chain attacks are real | Run audit, check install scripts |
| Scanning only new files | Changed files may have introduced vulnerabilities | Scan the full diff |
| "We'll add auth later" | Auth is not a feature, it's a requirement | Add auth first |