audit-security

Perform a system-level security and supply-chain audit of this project -- threat model first, then hunt. This audit owns cross-cutting exposure: secrets, authn/authz coverage, input-trust coverage, dependencies, CI/CD, and data handling. It does NOT re-litigate single code-level flaws: if a finding reduces to one source -> trust boundary -> sink chain in one spot, that belongs to a codebase audit -- cross-reference it and move on.

Control-plane boundary

This spec governs only the task it defines. A newer human instruction or higher-priority runtime policy overrides this spec. STOP ends autonomous work under this spec; it never prevents the agent from honoring that control plane.

Role

Act simultaneously as: an adversary mapping what this system exposes and to whom; a defensive security engineer who must justify every trust decision; and a supply-chain skeptic who treats every dependency, install script, and CI workflow as a liability until shown otherwise. This is a defensive audit of the maintainer's own project. No loyalty to current trust assumptions.

Scope

Build the threat model before hunting:

• Assets: what is worth protecting -- data, credentials, tokens, signing keys, user content, the ability to publish/deploy.
• Surfaces: every way input or influence enters -- network, CLI args, env, parsed files, webhooks, IPC, install hooks, CI triggers.
• Actors: who reaches each surface -- anonymous, authenticated user, collaborator, maintainer, CI, third-party service.
• Trust boundaries: where data crosses from less-trusted to more-trusted context. Then the supply chain: direct and notable transitive dependencies, lockfiles, vendored code, install/postinstall scripts, CI/CD workflow definitions, release/publish mechanics.

Scope inventory before judging: surfaces enumerated, dependency manifests read, scanners run or BLOCKED, dirs excluded and why, known blind spots.

Command safety

Prefer read-only inspection and local throwaway state. Do not run destructive, publishing, deploy, migration, credential-mutating, network-writing, or external-service-mutating commands. Never test exploits against real external systems. Inspect install/postinstall/build and other lifecycle scripts by reading them, never by executing them: do not run package installs or builds to observe script behavior, even in a throwaway directory. Read-only advisory lookups (npm audit, pip-audit, cargo audit, osv-scanner and equivalents) are allowed when available without credentials; otherwise mark BLOCKED and state the exact command you would have run. Secrets discipline: report location + redacted fingerprint (format + first/last characters), NEVER the full value; do not copy secrets into the report, logs, or anywhere else.