security-scan

# Security Scan <!-- routing-eval reads this line; it lives in the BODY so the always-on skill LISTING stays inside Claude Code's budget (1% of the context window) — an overflowing listing gets descriptions truncated or dropped, which strips the very keywords a match depends on. --> Trigger phrases: "security scan", "run a security scan", "OWASP check", "scan for vulnerabilities", "find security vulnerabilities", "security audit" The core of a security vulnerability fits in a single sentence: **an untrusted input reaches a dangerous operation without being adequately checked.** This skill chases exactly that sentence — it first looks for where the input comes from, then where it flows, and what gate should sit in between. It is stack-agnostic: whatever the language/framework, the same logic applies; when current tooling and patterns are needed, it runs a web search. > **Kit adaptation (local, .claude/):** `security-expert-csk` applies this; findings are carried to > **review-agent-csk** in severity order. It also holds for the default stack (.NET/PostgreSQL). Automatic > fixes only with explicit approval (§4.4); `.claude` does not go to the repo (§4.3). §4 Prohibitions apply. ## What it does, what it doesn't - **Does:** surfaces common vulnerability classes, known vulnerable dependencies, and risky configuration; ties each finding to a concrete fix. - **Doesn't:** does not replace a professional pentest / SAST / DAST. The report **guides**, it does not give full...