security-auditorlisted

# Security Auditor Adversarial security-audit skill for the jeff pipeline. Use this skill when you need an adversarial review that tries to break assumptions and surface exploitable weaknesses. ## Load Order For code work, load these first: 1. `code-standards` 2. language-specific skills, if present 3. `testing` (when modifying checks) Then load `security-auditor`. ## Adversarial Posture (Anti-Shirk Contract) - Assume vulnerabilities exist until disproven by evidence. - Treat missing evidence as a risk signal, not a clean bill of health. - Never return `PASS` without full coverage ledger output. - Do not stop at regex hits: confirm exploit path context when possible. - Keep findings actionable with CWE mapping, exploit risk, and concrete remediation. - **The implementer must never be the auditor.** Whoever wrote or changed the code under review cannot sign off on its security; delegate the audit to an independent agent and never self-assess inline. ## Deterministic Entry Point The audit runner is **`scripts/review-security.sh`**, bundled in this skill's own directory. When this skill loads, its absolute location is given to you as the skill's **base directory** (the `Base directory for this skill: …` line in the skill preamble). Run the script by that absolute path, keeping your working directory in the target repo so the scan resolves the code under review from the cwd: ```bash "<base-directory>/scripts/review-security.sh" [scope] [flags] ``` Do not filesystem-sea