| name | security |
| description | Run authorized repository security scans for vulnerabilities, dependency risk, secrets, and binary policy. Triggers: "security", "run repository security scans for", "security skill". |
| practices | ["supply-chain-integrity","design-by-contract","sre"] |
| hexagonal_role | driven-adapter |
| consumes | ["repo-context"] |
| produces | ["security-gate-summary.json","suite-summary.json","redteam-results.json"] |
| context_rel | [{"kind":"supplier-to","with":"validate"}] |
| skill_api_version | 1 |
| context | {"window":"fork","intent":{"mode":"task"},"sections":{"exclude":["HISTORY"]},"intel_scope":"topic"} |
| metadata | {"capabilities":["security"],"effects":["write_scan_artifacts"],"canonical_status":"canonical","disposition":"keep_specialist","graph_root":true,"tier":"product","dependencies":[]} |
| output_contract | stdout: security scan report |
Security Skill
Purpose: Run repeatable security checks across code, scripts, authorized binaries, and repo-managed prompt surfaces.
Use this skill for a caller-requested repository scan, authorized binary assurance, dependency risk, secrets, or offline prompt-surface redteam.
Critical Constraints
- Scan only repositories, binaries, and prompt surfaces the operator owns or is explicitly authorized to assess. Why: a security review does not grant access to third-party systems or proprietary material.
- Keep collection read-only by default; do not exfiltrate secrets, execute destructive payloads, or mutate policy/baselines to manufacture green. Why: the assessment must not become the incident or erase its evidence.
- Treat missing/error scanners as a coverage gap, never a clean finding; use
--require-tools when complete tool coverage is required. Why: absent evidence is not evidence of absence.
- Use the current agent and local shell; do not start another runtime or orchestration substrate unless explicitly requested. Why: repository scanning is a bounded operation, not permission to fan out.
- Run the selected scan once and report findings plus coverage gaps. Remediation,
risk acceptance, reruns, and promotion are caller decisions.
Security Surfaces
- Repository gate:
scripts/security-gate.sh composes available scanners for quick/full/release checks.
- Composable suite:
scripts/security_suite.py provides static, dynamic, contract, baseline, and policy primitives for authorized binaries.
- Offline redteam:
scripts/prompt_redteam.py checks repo-owned prompt and tool-control surfaces against the attack pack.
This is the canonical security runbook. Suite policy gating produces machine-consumable outputs, including policy/policy-verdict.json when a policy file is supplied.
Read the suite runbook before binary, policy, baseline, or redteam work. Use the OWASP checklist for code-level review.
Execution Workflow
1) Quick gate
Run:
scripts/security-gate.sh --mode quick
Checkpoint: preserve the exit code and verify the reported security-gate-summary.json exists and parses before triage.
