security-audit

Plugin security-audit from marketplace agent-security-audit in nguyenhx2/agent-security-audit. Commands read from the repo's manifest — 12 days ago.

Skills (1)

• security-audit

  Read-only security audit of one or more repositories: evidence-anchored findings, Markdown, HTML and Excel reports. Detects the stack and industry (web, mobile, IaC, CI/CD, AI agents, payments; health, finance, e-commerce, public sector, education, IoT/OT) to pick versioned standards (OWASP Top 10:2

Subagents (4)

• security-audit-finding-verifier

  Adversarial verifier for security-audit lane candidates - tries to refute each one by re-reading the code path independently, merges duplicates by remediation action, and writes the consolidated table plus a findings draft. Used by the security-audit skill in Phase 5, after all lanes return.

• security-audit-lane-reviewer

  Read-only security reviewer for one audit lane or lane group (authz-logic, injection-dataflow, sensitive-data, ai-agentic, supply-chain-infra, mobile, perf-quality) of one repository. Hunts design-level defects scanners cannot see, triages assigned scanner candidates, returns evidence-anchored candi

• security-audit-recon-mapper

  Read-only reconnaissance for a security audit - maps entry points, trust boundaries, auth/authz mechanisms, data stores, and sensitive surfaces of one repository and returns a compact attack-surface map with hypotheses. Used by the security-audit skill in Phase 1 at Standard/Deep depth, one per repo

• security-audit-report-translator

  Translates the canonical security-audit findings.json and narrative.json into one other report language, keeping every code, id, path and standard name unchanged. Used by the security-audit skill in Phase 7 when two or more report languages are chosen, one instance per extra report language, in para

Similar plugins