security-liability-auditlisted

# Security & Liability Audit Perform a combined technical security and legal liability review of recent code changes. Open with one sentence saying what you are about to do and what it will produce. ## Scope Detection Determine what to audit: 1. **If dispatched by session-post-implementation**: audit uncommitted + recent commit changes 2. **If invoked standalone**: use `git diff` (uncommitted) or `git diff HEAD~1` (last commit) 3. **If argument provided** (e.g., `HEAD~3..HEAD`): use that range Run `git diff --stat` to get the list of changed files. Read full files for context around changes. ## Part A: Technical Security Read `references/technical-security.md` for the full pattern library. Apply these checks to changed files: ### A1: Secrets Scan Grep changed files for known secret prefixes (AWS, OpenAI, GitHub, Slack, Stripe patterns). Check .env handling and frontend env var exposure. ### A2: LLM/AI Security If changes touch LLM/AI code: check for prompt injection vectors, unsanitized AI output rendering, code execution of AI responses, unvalidated tool calls, and unbounded LLM cost exposure. ### A3: Agentic Security If changes touch agent/tool/MCP code: run the Lethal Trifecta assessment (private data access + untrusted content + exfiltration vectors). Verify security boundaries are OS-enforced, not prompt-enforced. ### A4: OWASP Checks Apply focused OWASP Top 10 checks to changed code: injection (SQL, command, path traversal), broken access control, security m