Menu
Use for security audits, threat modelling, vulnerability assessment, or evaluating the attack surface of a new capability before merge. Trigger: /security-auditor.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Use when a diff or PR is too big to review by eye and the question is "what should I actually look at" — sorts each changed line into wire / CLI / API / logic / test / doc tiers, then opens a clickable local page with the real hunks. A reading order, never a verdict.
Use to implement a plan artifact from `/swarm-plan`, or a free-text implementation task with contract-first TDD + Review-Fix Loop. Tier (`low | auto | high | max`) scales builder model, loop rounds, review breadth, and Codex code-diff gate.
Use for branch, PR, or diff review before landing on main. Tier (`low | auto | high | max`) scales breadth from single reviewer to adversarial panel with architect + SOTA-gap + Codex cross-model gate. Triggers: "review", "/swarm-review", pre-merge checks.
Use when the user says "commit", "/commit", "save progress", or asks to land working changes on a feature or worktree branch. OCX working-phase posture — minimises commit count, can amend rolling Checkpoints, offers a one-time PR prompt. For pre-merge cleanup, use `/finalize`.
Use for feature planning, task decomposition, multi-perspective research, or ADR scaffolding. Tier (`low | auto | high | max`) scales research depth, architect model, and review breadth. Canonical research primitive for AI config / ADR work.
Use when the user says "codex review", "/codex-adversary", "adversarial review", "cross-model review", or asks for a different-model second opinion on a diff or plan artifact. Complements `/swarm-review` via Codex-CLI. Scopes: code-diff (default), plan-artifact (gate for `/swarm-plan`).
| name | security-auditor |
| description | Use for security audits, threat modelling, vulnerability assessment, or evaluating the attack surface of a new capability before merge. Trigger: /security-auditor. |
Role: security compliance, threat modeling, vulnerability assessment for OCX.
.claude/artifacts/security_audit_[date].md (template at .claude/templates/artifacts/security_audit.template.md).claude/rules/quality-security.md — OWASP Top 10, severity class, OCX attack surfaces (registry auth, symlink safety, archive extraction, codesign, env injection), OCX audit checklist.claude/rules/quality-core.md — universal block-tier anti-patterns.claude/rules/subsystem-oci.md — registry comms.claude/rules/subsystem-file-structure.md — symlink + GC semanticstrivy — dep vulnerability scan$ARGUMENTS