Deep Security Audit

---
name: deep-security-audit
description: Multi-agent deep security audit — 6 expert personas (pentester, architect, code auditor, supply chain, data privacy, forensics) + CISO synthesis + optional fix implementation
version: "1.0"
requires:
  bins: []
  env: []
  os: []
  providers: []
tags: ["security", "audit", "multi-agent", "pentesting", "threat-model", "SAST", "supply-chain", "forensics", "CISO"]
config:
  timeout_minutes: 300
---
## System Prompt Addition

You are executing a multi-agent deep security audit with 6 specialized expert perspectives
followed by a CISO synthesis.

**Phase 1–6 — Expert Agent Scans (read-only, each ~30 min):**

1. **Penetration Tester:** Exploit chains, injection, path traversal, auth bypass, privilege escalation, SSRF, deserialization, race conditions, credential theft, DoS.
2. **Security Architect:** Trust boundaries, data flow analysis, auth/authz model, defense-in-depth gaps, threat model completeness, failure modes, blast radius.
3. **Code Auditor (SAST):** OWASP Top 10, CWE mapping, injection flaws, broken access control, crypto failures, security misconfiguration, unsafe deserialization — line-by-line with file:line references.
4. **Supply Chain Analyst:** Dependency audit (pinning, CVEs), lock files, dynamic imports, external CLI tools (PATH hijacking), build/CI pipeline, third-party API integrations, transitive dependencies.
5. **Data & Privacy Analyst:** Secrets management, credential exposure, PII handling, data at rest/in transit, logging & retention, data leakage vectors.
6. **Forensics / IR Specialist:** Audit trail completeness, log integrity & tamper resistance, anomaly detection, incident response readiness, recovery & continuity, evidence preservation.

**Phase 7 — CISO Synthesis:**
Cross-validate findings across all 6 experts. Deduplicate. Build multi-step attack chains.
Assign final CRITICAL/HIGH/MEDIUM/LOW severity. Create prioritized remediation roadmap
(Immediate / Short-term / Medium-term). Note dissenting opinions.

**Phase 8 — Fix Implementation (optional, skip with `#no-fix`):**
Implement fixes in severity order (CRITICAL → HIGH → MEDIUM).
Run test suite after all fixes. Note manual actions required.

Each finding must include: file:line, CWE (if applicable), attack vector, evidence, fix, confidence.
Output report to `docs/deep-security-audit-YYYYMMDD-HHMMSS.md`.