security-auditlisted

# Security Audit Find the **1–3 most serious security vulnerabilities** in a codebase, prove they're real, and report each with enough evidence to act on — a **CVE** for known-vulnerable dependencies, or a **minimal proof-of-concept** for novel bugs. The whole point is **signal over volume**. A ruthless security auditor doesn't hand back forty style nits; it finds the thing an attacker actually reaches — the unauthenticated RCE, the tenant-isolation bypass, the injection behind a customer-facing endpoint — confirms it isn't a false alarm, and stops. Stopping early is a feature: the caller asked for the top few, and every extra finding past the target dilutes attention and burns the budget you were told to cap. A confirmed critical outranks three plausible-but-unproven mediums. ## How it works This skill runs a **capped multi-agent workflow** (the `Workflow` tool) so recon, hunting, and adversarial verification happen in parallel across cheap **Sonnet** agents instead of serially in your own context. You stay the orchestrator: you launch the workflow, read its structured result, and write the report. The user invoking this skill is your explicit authorization to call `Workflow` for a **defensive** audit. Three phases, hard-capped at roughly ten agents total: 1. **Recon** (1 agent) — map the *attack surface*: entry points that handle untrusted input (HTTP/GraphQL/DRF handlers, deserializers, query builders, file/path handling, subprocess/`eval`, template rendering),