cybersecurity-risk-routing

name	cybersecurity-risk-routing
description	Use when work includes cybersecurity review, app security, web application security, AI security, MCP/tool security, vulnerability triage, incident response, supply chain security, cloud/IAM/container security, phishing/red-team/scanning requests, or any security-sensitive audit, implementation, verification, or release decision. Routes light security reviews through forensic security audits and enforces authorization gates for dual-use work.
activation	Activate when the description trigger applies to the current task.
required_inputs	Task request, relevant repository context, constraints, and authority dependencies.
required_outputs	Skill-specific artifact, verification evidence, canonical verdict, and next action.
authority_dependencies	00_start_here/SOURCE_OF_TRUTH.md; 10_governance/APIVR_EXECUTION_LIFECYCLE.md; 10_governance/source_of_truth/Elite_Build_Goals_v3.md.
evidence_requirements	Executed checks or an honest Unknown, Not Run, or Blocked state for every material claim.

Cybersecurity Risk Routing

Use this skill as the first cybersecurity decision point. It does not replace APIVR; it selects the right security depth and the right specialist skill.

Security work that tests, scans, exploits, phishes, collects credentials, executes malware, probes cloud tenants, performs cross-tenant testing, or targets systems outside the workspace requires explicit authorization, written scope, targets, rules of engagement, stop conditions, and a containment plan. If authorization is missing, stop and provide a safe planning checklist only.

Required Files

Load when cybersecurity routing is in scope:

• 40_knowledge/CYBERSECURITY_RISK_ROUTING_INDEX.md
• 40_knowledge/SECURITY_FRAMEWORK_MAPPING.md
• 60_templates/SECURITY_AUTHORIZATION_AND_SCOPE_TEMPLATE.md when dual-use or live-system testing may occur
• 60_templates/SECURITY_EVIDENCE_LEDGER_TEMPLATE.md for Standard and above security work
• 50_audits/WEB_APPLICATION_SECURITY_AUDIT.md, skills/web-application-security/SKILL.md, and 60_templates/WEB_APPLICATION_SECURITY_EVIDENCE_LEDGER_TEMPLATE.md when a web application surface is in scope

APIVR Security Routing

• Phase 1 Audit: identify asset, owner, data sensitivity, attack surface, authorization status, live-system impact, and applicable frameworks.
• Phase 2 Plan: choose tier, security modules, evidence, stop conditions, rollback/containment, and authorization boundaries.
• Phase 3 Implement: perform only approved defensive checks or scoped tests; do not exceed authorization.
• Phase 4 Audit Implementation: check scope drift, evidence quality, safety controls, and whether findings are reproducible.
• Phase 5 Verify Implementation: verify remediation, mitigations, detection, or release gates with documented evidence.
• Phase 6 Re-Audit: classify residual risk, owners, time-bound exceptions, and next security action.

Tier Router

flowchart TD
  A["Security-relevant request"] --> B{"Live target, exploit, scan, phishing, credential, malware, cross-tenant probe, or third-party system?"}
  B -- "Yes" --> C{"Written authorization and scope present?"}
  C -- "No" --> D["STOP: safe planning checklist only"]
  C -- "Yes" --> E["Comprehensive or Forensic"]
  B -- "No" --> F{"Private data, auth, payments, production, web app, AI tools, CI/CD, cloud, or incident?"}
  F -- "Yes" --> G["Comprehensive unless confirmed narrow"]
  F -- "No" --> H{"Small reversible code/config review?"}
  H -- "Yes" --> I["Rapid or Standard"]
  H -- "No" --> J["Standard"]

Specialist Routing