security

# Security Skill > **Purpose:** Run repeatable security checks across code, scripts, authorized binaries, and repo-managed prompt surfaces. Use this skill for a caller-requested repository scan, authorized binary assurance, dependency risk, secrets, or offline prompt-surface redteam. ## Critical Constraints - Scan only repositories, binaries, and prompt surfaces the operator owns or is explicitly authorized to assess. **Why:** a security review does not grant access to third-party systems or proprietary material. - Keep collection read-only by default; do not exfiltrate secrets, execute destructive payloads, or mutate policy/baselines to manufacture green. **Why:** the assessment must not become the incident or erase its evidence. - Treat missing/error scanners as a coverage gap, never a clean finding; use `--require-tools` when complete tool coverage is required. **Why:** absent evidence is not evidence of absence. - Use the current agent and local shell; do not start another runtime or orchestration substrate unless explicitly requested. **Why:** repository scanning is a bounded operation, not permission to fan out. - Run the selected scan once and report findings plus coverage gaps. Remediation, risk acceptance, reruns, and promotion are caller decisions. ## Security Surfaces 1. **Repository gate:** `scripts/security-gate.sh` composes available scanners for quick/full/release checks. 2. **Composable suite:** `scripts/security_suite.py` provides static, dynamic, con...