Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-mapping skill that reads and edits project documentation, with its persistent agent-guide changes disclosed and bounded.
Review the documentation diff before keeping the changes, especially AGENTS.md or CLAUDE.md because those files affect future agent behavior. Use it only on a repository you intend to map, and keep the stated boundaries: no secrets, no application-code behavior changes, no automatic feedback submission, and no commit/push/deploy unless separately requested.
The skill metadata says to use or offer the skill when asked to 'map', 'optimize tokens', or 'slim CLAUDE.md/AGENTS.md', and also whenever an entry point grows past about 8 KB. These are broad, common phrases and heuristics that can cause the skill to activate in unrelated documentation tasks, increasing the chance of unsolicited repository-wide doc edits and unexpected behavior.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **Put box layout, process manager, web-server routing and known gotchas in the deployment guide**, verbatim. Hostnames and paths that already live in tracked files can move with them. Do not copy them into a router.
- **Put the CI walkthrough and its secret names in a CI guide.** Put the env-var table in a configuration guide.
- **Keep the rule itself in the entry point**: for example, "merging into `main` deploys", "never deploy without the security check", "never push to `main` without approval". The procedure moves; the rule stays.
- **Then search scripts, workflows and skills** for "see CLAUDE.md" and repoint each one to the procedure's new home.