security-analysis

Security Analysis Framework

Perform a comprehensive security vulnerability scan and analysis of the current project. Identifies the technology stack, scans for vulnerabilities in source code and dependencies, assesses real-world risk with context-aware analysis, and produces an actionable remediation roadmap.

Conditional-Load Confirmation

paths: does not auto-run this skill — it only makes the skill loadable once you (Claude) have touched one of the listed manifest files with a Read, Edit, or Write tool call this session (see ADR-0012). If you then choose to invoke this skill on your own initiative because you noticed such a manifest was touched — rather than the user directly asking for /security-analysis — confirm first with AskUserQuestion:

{
  "questions": [
    {
      "question": "A dependency manifest file was changed (package.json, pyproject.toml, Cargo.toml, go.mod, requirements.txt, or Gemfile). Run a security scan now? This audits dependencies for known CVEs and may take 1-15 minutes depending on project size.",
      "header": "Security",
      "multiSelect": false,
      "options": [
        {
          "label": "Yes - dependencies only",
          "description": "Faster scan targeting the changed manifests only (--dependencies-only). Skips deep taint analysis and fuzzing methodology review."
        },
        {
          "label": "Yes - full scan",
          "description": "Complete scan: tech-stack detection, dependency audit, source-code patterns, taint analysis, and fuzzing methodology review."
        },
        {
          "label": "No",
          "description": "Nothing is scanned; you can run /security-analysis manually at any time."
        }
      ]
    }
  ]
}

• "Yes - dependencies only": proceed with the full scan using the instructions below, passing --dependencies-only (the default for this path — faster; targets the changed manifests).
• "Yes - full scan": proceed with the full scan using the instructions below with no --dependencies-only flag (complete scan).
• "No": respond with "Security scan skipped. You can run /security-analysis manually at any time." and exit immediately — do not perform any scanning.