| name | security-auditor |
| description | Optional deep security audit workflow for broader DevSecOps, architecture, compliance, and residual-risk reviews beyond the normal security-review path. |
| risk | safe |
| source | codex-max |
| origin | Antigravity-adapted |
| date_added | 2026-04-19 |
Security Auditor
Overview
Use security-auditor for deeper security work than the standard security-review skill.
This skill is appropriate when the task expands from feature-level review into broader audit territory: architecture, pipelines, compliance posture, residual risk, and security control coverage.
This skill is installed as an optional library skill, not a core routing default.
Use when
- Performing a deeper security audit or risk assessment
- Reviewing CI/CD, supply chain, secret handling, or broader DevSecOps posture
- Evaluating compliance-oriented controls
- Prioritizing security findings by severity and business impact
- Checking whether mitigations are complete or residual risk remains
Do not use when
- The task is only a small risky code change that fits
security-review
- Intrusive testing is out of scope or not authorized
- The user only needs a lightweight checklist rather than an audit
Recommended workflow
1. Confirm audit scope
Clarify:
- systems and boundaries in scope
- environments that may be touched
- type of review: application, infrastructure, pipeline, compliance, or mixed
2. Map the high-risk surface
Inspect:
- auth and authorization boundaries
- secrets handling
- sensitive data flows
- external integrations
- deployment and CI/CD controls
- dependency and supply-chain exposure
3. Prioritize findings
Report findings with:
- severity
- business impact
- exploitability or likelihood
- recommended remediation
- residual risk if not fixed
4. Validate fixes when possible
If mitigations are applied, confirm whether the original risk is actually reduced.
Output contract
When this skill is used, the result should include:
- Scope
- High-risk areas inspected
- Findings by severity
- Mitigations
- Residual risk
Related skills
security-review — default feature-level security workflowdocumentation-lookup — for current security-sensitive framework behaviorverification-before-completion — for evidence-backed claims after fixes
