ce-probe-sec

# Probe Sec **Invocation input:** Target (URL for web/API, or a binary/command for CLI): $ARGUMENTS Probe a running target for security issues. This is the **dynamic** security tool — it exercises a live instance or binary. For *static*, code-level review of pending changes, use `/ce-review`'s Security lens (see the boundary below). Sister to `/ce-ux-audit`: same evidence-bound finding *discipline* (every finding cited, triaged, escalated — though each tool's finding fields and evidence-state vocabulary differ), same triage discipline, same escalate-up chain. **Not a pentest** — a first cut that surfaces leads for a human security professional; mature scanners do the deep work where installed. ## Architecture — spine + per-type modules This skill (`SKILL.md`) is the **spine**: it owns the workflow arc, the consent gates, the evidence model, triage, and the report. The **per-type probe content** lives in modules loaded on demand at Stage 0: | Target type | Detect by | Load module | Consent gate | |---|---|---|---| | Web / API | argument is a URL (or `--type http`) | `${CLAUDE_SKILL_DIR}/probes-http.md` | Gate A — Remote-Target Attestation | | CLI / console | argument is a binary/command (or `--type cli`) | `${CLAUDE_SKILL_DIR}/probes-cli.md` | Gate B — Local-Execution Sandbox | | (ambiguous) | — | ask the human | — | Load exactly one module per run. Adding a type later = a new `${CLAUDE_SKILL_DIR}/probes-<type>.md` + one row here; the spine never changes. **The probe ...