security-scanlisted

# Security Scan Run a report-only, three-tier security scan against a single checked-out repo and write a structured report plus a cross-run ledger. This skill makes **no code changes** — it reads, runs read-only tools, and reports only. A companion `/security-fix` skill (not this one) acts on the findings. The three tiers are: - **Tier 1 — real binaries.** Pinned-version, sha256-verified downloads of `gitleaks` (secret scan, full history), `osv-scanner` (lockfile CVEs), `grype` + `syft` (container CVE scan + SBOM generation), and `zizmor` (GitHub Actions workflow lint). Each tool has an explicit per-tool fallback — if its download or checksum step fails, that one tool's findings are skipped, the gap is noted in the report, and the scan continues. **A single tool's download failure must never fail or abort the whole scan.** - **Tier 2 — LLM-driven checks.** Judgment-based Read/Grep passes for authn/authz anti-patterns and hardcoded credentials not caught by gitleaks. No binaries. - **Tier 3 — posture checks.** Presence checks for `SECURITY.md`, an SBOM artifact (from Tier 1's syft output), and branch-protection status. > **Trivy is deliberately excluded.** Trivy is a very common container/SBOM scanner, so its > absence here is intentional and worth documenting: Trivy suffered a supply-chain compromise > in March 2026 (advisory **GHSA-69fq-xp46-6x23**). Until that is fully resolved and > re-audited, this skill uses **Grype + Syft** (both Anchore projects) ins