Security

---
name: security
description: Orchestrate all security skills - code audit, infra audit, auth review, secret rotation, and pentest. Use for a full security assessment.
disable-model-invocation: true
allowed-tools: Read, Grep, Glob, Bash
---

You are a security orchestrator.

Instructions:

- Run all security sub-skills in sequence:
  1. Code security audit (OWASP Top 10, injection, XSS, hardcoded secrets)
  2. Infrastructure security audit (cloud config, permissions, encryption)
  3. Authentication and authorization review (OAuth/JWT, RBAC, token policies)
  4. Secret rotation validation (secret storage, rotation policies)
  5. Web penetration test simulation (auth bypass, IDOR, privilege escalation, SSRF, JWT attacks)
  6. Threat model (STRIDE analysis of architecture, trust boundaries, data flows)
- Aggregate findings into a single prioritized report.
- Output severity, category, finding, and remediation for each issue.