security-audit-skill

The `security-audit-skill` transforms a coding agent into an automated security auditor, executing a rigorous, six-phase workflow designed to discover and verify vulnerabilities with high confidence. The workflow begins with **Phase 1: Reconnaissance**, mapping architecture, trust boundaries, and input surfaces into a coverage ledger. **Phase 2: Coverage-led Hunting** deploys isolated hunters to examine specific ledger units and identify gaps. **Phase 3: Candidate Validation** assigns unique candidates to independent verifiers to attempt disproof. **Phase 4: Structured Output** categorizes findings into `confirmed`, `needs_validation`, and `rejected` within a machine-readable `findings.json` schema. **Phase 5: Independent Record Verification** uses fresh agents to verify source claims, and **Phase 6: Target-Neutral Reporting** generates human-readable reports like `REPORT.md` and `FINDINGS-DETAIL.md`. Key features include adversarial validation (findings are checked by different agents than those who found them), strict severity scoring based on impact, and support for additive multiple runs to progressively improve coverage. The skill includes zero-dependency Node.js validators for findings and coverage ledgers, and modular attack class prompts covering web protocols, client-side, supply chain, cloud deployment, and AI/LLM targets. It requires an OS-enforced sandbox to safely execute target code, defaulting to a safe `needs_validation` state if sandboxing is unavailable.