/security

name: security
description: 'Review code or scan for security vulnerabilities, secrets, dependencies and prompt risks. Use when: concrete exposure needs assessment; never silently change policy.'
practices:
- supply-chain-integrity
- design-by-contract
- sre
hexagonal_role: driven-adapter
consumes:
- repo-context
produces:
- security-gate-summary.json
- suite-summary.json
- redteam-results.json
context_rel:
- kind: supplier-to
  with: validate
skill_api_version: 1
user-invocable: true
context:
  window: fork
  intent:
    mode: task
  sections:
    exclude:
    - HISTORY
metadata:
  capabilities: [security]
  effects: [write_scan_artifacts]
  canonical_status: canonical
  disposition: keep_specialist
  graph_root: true
  tier: product
  dependencies: []
output_contract: 'stdout: security scan report'

Security Skill

> **Purpose:** Run repeatable security checks across code, scripts, authorized binaries, and repo-managed prompt surfaces.

Use this skill for a caller-requested repository scan, authorized binary assurance, dependency risk, secrets, or offline prompt-surface redteam.

Critical Constraints

• Scan only repositories, binaries, and prompt surfaces the operator owns or is explicitly authorized to assess. **Why:** a security review does not grant access to third-party systems or proprietary material.
• Keep collection read-only by default; do not exfiltrate secrets, execute destructive payloads, or mutate policy/baselines to manufacture green. **Why:** the assessment must not become the incident or erase its evidence.
• Treat missing/error scanners as a coverage gap, never a clean finding; use `--require-tools` when complete tool coverage is required. **Why:** absent evidence is not evidence of absence.
• Use the current agent and local shell; do not start another runtime or orchestration substrate unless explicitly requested. **Why:** repository scanning is a bounded operation, not permission to fan out.
• Run the selected scan once and report findings plus coverage gaps. Remediation,

risk acceptance, reruns, and promotion are caller decisions.

Prompt

Run a full security scan on cli/ in the fleet-router repo: dependency risk, secrets, and static analysis. Keep collection read-only, treat any missing scanner as a coverage gap, and report findings plus coverage gaps rather than remediating them.

It's working if

• The report lists which scanners ran, e.g. `gosec ./...`, and marks any missing tool as a coverage gap, never a clean pass.
• Collection stays read-only throughout: no `curl`, `rm`, or credential read appears in the transcript.
• Findings cite a file and line, such as `cli/internal/auth/token.go:42`, never a vague category.
• The response's `findings` and `coverage gaps` stay separate from any remediation step, left as caller decisions.

Security Surfaces

1. **Repository gate:** `scripts/security-gate.sh` composes available scanners for quick/full/release checks. 2. **Composable suite:** `scripts/security_suite.py` provides static, dynamic, contract, baseline, and policy primitives for authorized binaries. 3. **Offline redteam:** `scripts/prompt_redteam.py` checks repo-owned prompt and tool-control surfaces against the attack pack.

This is the canonical security runbook. Suite policy gating produces machine-consumable outputs, including `policy/policy-verdict.json` when a policy file is supplied.

Read [the suite runbook](references/security-suite-runbook.md) before binary, policy, baseline, or redteam work. Use [the OWASP checklist](references/owasp-checklist.md) for code-level review.

Execution Workflow

1) Quick gate

Run:

scripts/security-gate.sh --mode quick

**Checkpoint:** preserve the exit code and verify the reported `security-gate-summary.json` exists and parses before triage.

2) Full scan

Run:

scripts/security-gate.sh --mode full

Add `--require-tools` when skipped scanners would invalidate the assurance claim. **Checkpoint:** report the result as incomplete unless the selected artifact validator and process both succeed.

3) Scheduled gate

Scheduled automation runs the full gate against the intended branch and retains its artifact directory. A failing scheduled run creates actionable tracked work; AgentOps itself does not supply the scheduler.

4) Hunt discipline

For review work beyond the scripted gates (code-level or redteam passes), hunt against the full taxonomy, not your first hunch:

• **Full-taxonomy hunt.** Walk every applicable class in

[the OWASP checklist](references/owasp-checklist.md) (or the attack pack for prompt surfaces) and record a per-class result: finding, clean, or not-assessed. An unvisited class is a coverage gap, not a clean. Chasing one suspicious lead to the exclusion of the taxonomy is the **first-scent fixation** failure mode.

• **Empirical proof per finding.** A finding is real when it reproduces: a

concrete input, request, or command demonstrating the behavior, captured in the artifact. Pattern-match-only findings are reported as suspicions, ranked below proven ones.

• **Fail-open probes.** For every guard, gate, or timeout on the surface, ask

what happens when it errors or hangs — then probe it where safe. A control that fails open under error is a finding even when its happy path is correct.

• **Identity-chain traces.** For authenticated or delegated flows, trace who

the effective identity is at each hop (user, service, token, hook). A hop where identity is assumed rather than verified — the **borrowed identity** failure mode — is a finding.

• **Quiet-round convergence.** Iterate full passes until one complete pass

yields nothing new: no new finding, no new coverage gap. That quiet round is the stop condition. Stopping after a loud round (findings still arriving) is premature; report the hunt as unconverged if the budget ends before a quiet round.

5) Triage

1. Open the latest artifact and identify s