full-security-audit

name	full-security-audit
description	Run a comprehensive 4-phase security audit on the codebase. Use for periodic security reviews, before major releases, or when touching auth/payments. Orchestrates the 4-phase security pipeline. Say 'security audit' or 'run security pipeline'.
contract	{"tags":["security","orchestrator"],"state_source":"security_plan","inputs":{"params":[],"gates":[]},"outputs":{"mutates":[],"side_effects":[]},"next":["1-security-audit"],"human_gate":false}

Full Security Audit

Orchestrates the 4-phase security pipeline. Each phase is its own skill — this skill tells you when to use the pipeline and how to run it.

When to Use This (vs. Lightweight Security)

Use Full Audit When:

• Periodic review — Monthly or quarterly security sweep
• Before major releases — Catch issues before production
• Touching sensitive code: auth/authz, payments, PII, new API endpoints, database schema changes
• After security incident — Verify no other vulnerabilities

Use Lightweight Security When:

• Routine feature development (security questions are built into /interview)
• UI-only changes
• Documentation or small bug fixes in non-sensitive code

---

How to Run

Option A: Sequential (Recommended)

Run each phase, review output, then proceed:

/1-security-audit          → Scan codebase, create SECURITY_PLAN.md
[Review findings]

/2-security-critique       → Red team review, rank the backlog
[Review priorities]

/3-security-spec           → Write failing test for top item
[Confirm test fails correctly]

/4-security-fix            → Fix the vulnerability
[Verify test passes, no regressions]