security-auditlisted

# Purpose Perform a static security audit of the project's application code, configuration, and infrastructure manifests. Produce a structured report listing vulnerabilities with file:line citations, OWASP category mapping, severity classification, and prioritized remediation steps. This skill covers application-level vulnerabilities: injection, auth bypass, secrets leakage, insecure configuration, and dependency CVEs. It does **not** cover CI/CD pipeline hardening, image scanning, or SBOM generation -- those belong to the `supply-chain-security` skill. # When to use this skill - User explicitly asks to "audit," "scan," or "review" code for security vulnerabilities - User asks about OWASP compliance for any of the project's repositories (see `.claude/project.json` → `repos`) - User asks to "find vulnerabilities," "harden auth," or "check for secrets" in application code - A new feature or module needs a security review before merge - Investigating a suspected auth bypass or injection risk # When NOT to use this skill - **CI/CD pipeline hardening, image scanning, SBOM generation** -- use `supply-chain-security` - **Active penetration testing, fuzzing, or exploit development** -- this skill is passive static analysis only - **Code quality review without security focus** -- use `code-standards` or `code-quality` - **Writing tests to reproduce a vulnerability** -- use `testing` - **Updating Cloud Run values or deploying fixes** -- use `deployment` or `deployment` - **Generi