Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed roadmap automation helper that can edit code and keep local run records, with no evidence of hidden execution or data exfiltration.
Install only if you want an agent to work through a roadmap autonomously. Review the task file first, be explicit about whether commits or pushes are allowed, and remember that local .claude/goal-runner records may contain task details, diffs, and command output.
The description says to use this skill whenever the user says phrases like "launch sub agents to work the tasks" or sets a /goal naming a roadmap/task file, even if they do not name the skill. Those activation conditions are broad enough to match ordinary project-management requests, which may cause unintended invocation despite the brief exclusion note for single tasks and reruns.
The skill instructs the agent to persist detailed task briefs, reports, diffs, assumptions, and progress state under .claude/goal-runner/<run>/. In a security context, this creates a retention surface for potentially sensitive repository details, task contents, and execution evidence that may later be read, exfiltrated, or accidentally committed if exclusion fails.
3. **Front-load the riskiest unknown.** Ask: what discovery would invalidate the whole approach? That is scout question #1 — answered before the coder starts, not after it fails.
4. **Sub-agent reports are testimony, not truth.** Quoted command output or a `file:line` citation upgrades a claim to evidence; anything else stays a hypothesis. Two agents disagreeing is signal — resolve it by re-deriving yourself (open the file, run the command), never by picking the more confident voice.
5. **Guard your own context.** The coordinator's window holds orchestration state — queue position, evidence ledger, assumptions. Details live and die inside sub-agents; that is *why* the main agent never codes. Hand artifacts over as **files, not pasted text**: write each coder brief to `.claude/goal-runner/<run>/task-N-brief.md` (`<run>` = the task file's name, lower-cased, without extension — `roadmap` for `ROADMAP.md` — so a resumed session finds the same directory), have the coder write its full report to `task-N-report.md` and return only status + file list + one-line test summary + concerns, and give reviewers the diff as a file (`git diff BASE..HEAD > task-N-diff.patch`). Everything you paste into a prompt or a sub-agent prints back stays resident in your window for the rest of the run.
6. **Keep a run ledger the next session can trust.** Conversation memory does not survive compaction; a coordinator that loses its place re-dispatches finished tasks — the single most expensive failure in long runs. Append one line per event to `.claude/goal-runner/<run>/progress.md`: `Task N: started (BASE <sha7>)`, `Task N: fix round R/2 (<open findings>)`, `Task N: complete (<evidence one-liner>[, commit <sha7>])`, `Task N: BLOCKED (<reason>)`, and every `Ruling: <what you decided> — <why> — <cost if wrong>`. After compaction or a `handoff` resume, trust the ledger and `git log` over your recollection: a task with a `complete` line is done; a task whose last line is a fix round resumes at the
...[truncated 25 chars]
The "When to use this skill" section lists several natural-language examples, but it does not clearly define the minimum criteria that distinguish this skill from nearby behaviors beyond two exclusions. Users saying they want to "work the roadmap until completion" may still leave ambiguity about whether this skill or another orchestration skill should activate.
No suspicious patterns detected.