A security audit skill that runs a two-phase workflow: a comprehensive vulnerability scan by the aegis agent followed by verification of fixes by the arbiter agent.
Tasks
Run a security audit of a full codebase, specific area, or single file using /security with the requested scope
Scan for injection attacks (SQL, command, XSS, LDAP), authentication/authorization issues, data protection problems, security misconfigurations, and dependency vulnerabilities
Verify security fixes after remediation using /security --verify, re-checking reported vulnerabilities and confirming fixes do not introduce regressions
Inputs
Scope for the audit (entire codebase, a specific area such as authentication, or a single file path)
Flags: --deps (dependencies only), --verify (re-run after fixes), --owasp (explicit OWASP Top 10 report), --secrets (focus on secret detection)
Outputs
Phase 1: a vulnerability report from the aegis agent including severity (CRITICAL/HIGH/MEDIUM/LOW), location (file:line), description, and remediation steps
Phase 2: a verification report from the arbiter agent covering security-focused tests, dependency audits, and re-checks of reported vulnerabilities
Limitations and checks
The Phase 1 scan prompt explicitly covers injection, authentication/authorization, data protection, configuration, and dependency checks; the source's OWASP Top 10 table claims all ten risks are checked, but the described scan steps do not explicitly address A08 Data Integrity Failures, A09 Logging Failures, or A10 SSRF
Dependency auditing is specified only for npm (npm audit) and Python (pip audit); coverage of other ecosystems or lockfiles is not documented
Sample report details in the example (files scanned, lines analyzed, blocking status) are illustrative output, not guaranteed report fields
Confirm the Phase 1 report from aegis includes severity, location (file:line), description, and remediation steps for each finding
For dependency-focused audits or verification, confirm npm audit or pip audit was run and note that other ecosystems are not documented as covered
During --verify, confirm each previously reported vulnerability was re-checked and that fixes were tested for regressions
Search
Find projects, verify facts, compare options, and filter by your requirements
Try a searchA click only fills the search box; you stay in control