Finds, validates, prioritizes, and describes fixes for source-grounded vulnerabilities in a codebase. Use when the user asks for a security audit, security review, or pen test of code, or to find vulnerabilities in web apps, APIs, services, CLI tools, libraries, or daemons.

Security Audit Find vulnerabilities that violate a real trust boundary, then give owners the source evidence, safe reproduction, priority, and smallest effective fix. This is a defensive, source first workflow. A candidate without a concrete affected principal, resource, or security outcome is not a confirmed finding. Platform terminology This skill is agent neutral: Parent is the agent that coordinates the run and owns shared state. Task tool is the platform's delegation or sub agent mechanism. research agent is a delegated agent for focused source exploration and factual verification. general agent is a delegated agent for broad investigation and bounded local execution. subagent type: in a heading names which of these two delegated agent roles runs that work. Use equivalent platform capabilities while preserving role, write isolation, prompt, and independence boundaries. Setup and execution boundary Resolve before reconnaissance: Skill directory : the absolute directory containing this SKILL.md . Target : the absolute repository root under review. Repo name : a stable repository identifier from the directory or local Git remote. Output directory : a new writable directory outside the target, defaulting to ~/security audit skill/<repo name /run <N , where <N is the next unused integer. Use a directory inside the target only when the user explicitly selects it and the parent verifies that version control ignores the whole directory. Otherwise stop and request an external path. Source ref : the reviewed commit and whether the worktree is dirty. Do not treat unreviewed generated or modified files as another revision. Source inspection is read only. Run target controlled builds, tests, processes, browsers, emulators, fuzzers, and fixture processing only inside an OS enforced sandbox that provides all of these controls: no external network; use only an isolated loopback namespace when the check needs local client/server traffic; an empty environment populated from an explicit allowlist with safe values, with scratch local HOME , temporary directories, and caches; a read only target and toolchain, with the target controlled process able to write only inside its assigned scratch/ directory; and explicit low CPU, memory, process, file size, disk, and wall clock limits. The agent, outside the target controlled process, may make a disposable source copy in scratch/ when a build must write beside source. Only trusted parent side code may promote the minimum non secret result to retained artifacts/ using the procedure under Write isolation. Never expose the output directory (other than the agent's own assigned scratch/ ), another agent's directory, the host home directory, credentials, sockets, or shared services to target code. Do not install dependencies or let builds fetch them. Use only tools and dependencies already available locally. If every control cannot be enforced, do not execute target code: retain a needs validation record with the missing sandbox capability as a blocker and a safe validation plan. Use dummy principals, fixtures, and secrets. Do not probe deployed endpoints, external services, shared infrastructure, production identities, other users' data, or live control planes. Do not test availability against a live or shared process, publish artifacts, alter releases, spend paid API quota, or continue beyond the minimum local effect needed to establish a defect. If the decisive fact is outside source or the sandboxed fixture, retain a needs validation record. Write isolation The parent creates and is the only writer of shared run files: run metadata.json architecture.md coverage ledger.json findings.json REPORT.md FINDINGS DETAIL.md NEEDS VALIDATION.md Each hunter or verifier receives a unique root under <output dir /agents/<agent id / , with separate scratch/ and artifacts/ directories. Canonical agent IDs match ^[a z0 9][a z0 9 ]{0,63}$ and must not equal a Windows device name such as con , prn , aux , nul , com1 through com9 , or lpt1 through lpt9 . Lowercase IDs prevent case fold collisions. The agent and every target controlled process may write only to scratch/ ; retained artifacts/ is parent owned, is never exposed to the sandbox, and is writable only by trusted parent side promotion code. Agents may not change shared files, target source, retained artifacts, or another agent's directory. Do not use /tmp or the host home directory as a writable fallback. Before execution, the parent opens and retains trusted, non inheritable directory descriptors for the agent's scratch/ and artifacts/ roots, and records an allowlist of expected scratch relative artifact files plus explicit per file and cumulative byte limits. Never pass those descriptors to the agent or sandbox. After the sandbox and all its processes terminate, trusted parent side code promotes each allowlisted file separately: 1. Validate the declared relative path: reject absolute, empty, . , .. , or symlinked components. 2. Walk each parent component from the retained scratch root descriptor with no follow directory relative operations; never reopen by path. 3. Open the leaf no follow and nonblocking. 4. Verify with fstat that it is a regular file with link count exactly one and within the recorded per file and cumulative byte limits. 5. Enforce those limits again while reading from that descriptor. 6. Copy exactly the verified size, repeat fstat , and reject a changed identity, type, link count, or size. 7. For the destination, walk every parent component from the retained artifacts root descriptor with no follow directory relative operations; require each existing component to be a real directory, and create any missing directory exclusively before reopening and verifying it no follow. 8. Create the leaf exclusively without following links, verify that the opened destination is a regular file with link count exactly one, and copy from the verified source descriptor without reopening either path. 9. Use equivalent race safe APIs on non POSIX systems. 10. Never recursively copy or glob scratch, extract an archive into artifacts, or open or promote a symlink, FIFO, socket, device, directory, hard linked file, changing file, or file that exceeds its bound. 11. If any check is unavailable, cannot be enforced, or fails, discard the scratch entry; if it is decisive evidence, retain needs validation with the exact promotion blocker. [HUNTING.md](HUNTING.md) and [VALIDATION AND REPORTING.md](VALIDATION AND REPORTING.md) carry this procedure as one identical fenced block for hunter and verifier prompts; it states the same rules in the same order as this list. For a reproduced check, record the command, exact test input, sandbox limits, and only the allowlisted environment variable names plus safe non secret values needed to reproduce it. Never capture or copy the ambient environment, inherited variables, credential values, authentication state, or unrelated host paths. Launch from an empty environment rather than trying to redact one after execution. Before delegation, the parent writes run metadata.json with at least run id , repo , target , source ref , profile , scope paths , budget (null if unset), execution policy: "sandboxed source and local only" , selected companion files, prior run paths, shared file owners, and run status: "in progress" . Update metadata only when those facts change; candidate state belongs in the coverage ledger and findings.json . Coverage and prior runs No one pass is complete. Build a deterministic coverage plan before hunting and update it after every agent result. [RECONNAISSANCE.md](RECONNAISSANCE.md) defines the stable coverage units and [HUNTING.md](HUNTING.md) defines coverage critic waves. The parent alone updates the ledger. If prior runs exist, read every compatible coverage ledger.json and findings.json before planning the current run: 1. Compare the relevant current source with each prior record and unit. A prior source ref alone is not evidence that a path is unchanged. 2. Carry a prior confirmed record into the current candidate set only when its relevant source and conditions are unchanged and its evidence still meets the current contract. Link it to a current ledger unit seeded planned , preserve its fingerprint, exclude only that carried root cause from hunters, and send the carried record through the current final verification path; the Phase 3 verifier that re checks it becomes that unit's assignment owner and moves it to candidate . 3. When relevant source for a prior confirmed record changed, create a current planned revalidation unit. Do not put that record on the hunter exclusion list. It remains confirmed only if current independent validation establishes the current path and result. 4. Make prior needs validation , deferred , blocked , out of scope , and any changed source unit current work. A still external needs validation record may be carried only after the current source trace is checked and linked by fingerprint to a current planned unit whose verifier re check supplies its owner and evidence; the record keeps the unresolved blocker. These prior states never suppress a current unit. 5. A prior same source covered unit may inform priority, but it remains visible in the current ledger. A prior rejected record suppresses only the unchanged failed claim, not coverage of its unit; changed evidence creates current work. 6. Read the prior profile and scope. A prior quick or scoped ledger contributes only its recorded evidence and gaps, never an implied "rest is fine." If no prior ledger exists, say so in the final coverage statement. Never imply that one run exhausts the target. Run profiles and scope Pick a profile during Setup — from the user's request, or by proposing one from the target's size and stakes — and record it in run metadata.json ( profile , scope paths ). State both in the report. The default is standard . quick — a bounded pass for small targets, re runs, or a fast first look. Coarsen ledger units to surface × boundary × attack class (subsystem uses the fixed canonical profile/quick/all in scope subsystems identifier), run exactly one hunter wave followed by exactly one final coverage critic pass, and use one fresh verifier per candidate for both candidate validation and final record verification. Do not launch a follow up hunter wave: record the critic's accepted discoveries and reassignments as deferred . standard — the workflow as written. deep — for high stakes or large targets. Split ledger units per subsystem and lifecycle mode, run critic waves to a clean pass, keep candidate validation and final record verification as separate fresh agents, and give prior covered same source units an independent second pass. A scoped run audits a subset: named paths, one subsystem, one companion domain, or the diff between two source refs. Seed ledger units only for in scope surfaces and record everything else as out of scope — never as covered . A scoped or quick run must present itself as partial coverage. Profiles change breadth and redundancy, never the evidence bar. Do not scale away the candidate gate, the source/local execution boundary, needs validation discipline, schema validation, or independent verification of confirmed records. Cost budget The ledger makes spend countable: one unit is roughly one hunter assignment, and one surviving candidate is one or two verifier assignments depending on profile. When the user sets a budget — or the parent proposes one for a large target — record budget in run metadata.json as a maximum number of agent invocations across all phases. Apply the strict budget gate before launching any reconnaissance agent. Reserve the four baseline reconnaissance calls, one final p

security-audit