security-auditlisted

# Security Audit **IMPORTANT: Start your response with a context preamble.** Call `help_lookup(topic="security-audit", mode="preamble")` and display the returned `preamble` text as a blockquote. Then tell the user they can say "tell me more" for a step-by-step guide, or answer the scoping questions below to proceed. If the MCP call fails, fall back to: > **Security Audit** — Scans your code for security > vulnerabilities — eval/exec, path traversal, hardcoded > secrets, injection risks. ## Scoping Before running, ask: 1. **Scope**: "Which path should I scan?" Default to the project root if the user says "everything." 2. **Focus**: "Any specific concern — secrets, injection, dependencies, or a full sweep?" ## Execution ### Shared command workspace (preferred) Open adapter `security-audit` with the validated path and focus. The invocation authorizes this read-only scan, so the running workspace has no confirmation action. Call `security_audit` and publish its exact outcome as `scan_result`, including health score, files scanned, and categorized path/line/severity/CWE findings. An incomplete scan must say “did not complete,” never “clean.” Critical/high findings render one per page with bound Previous/Next actions, avoiding a tall unscrollable form. `finish_security_audit` records the report; `handoff_to_fix` prepares an explicit Fix input containing all critical/high receipts but performs no mutation. Fix retains its own exact-command approval. Present the term