Security Scan

Trigger Signals

• the task touches auth, secrets, privileged routes, or network boundaries
• the repository is a service or security-sensitive runtime

Inspect First

• environment and config surfaces
• auth middleware, handlers, route guards, and secret-loading code
• dependency manifests and externally reachable entrypoints

Workflow

1. identify exposed trust boundaries and secret-bearing paths
2. inspect input validation, auth, and authorization behavior
3. review dependency, logging, and data-exposure risks
4. summarize concrete findings and remediation priorities

Output Contract

• attack-surface summary
• ordered findings with severity
• recommended remediations
• residual risk note

Failure Modes

• the task scope hides the actual runtime boundary
• there is no reliable way to trace user input to protected operations

Escalation

• escalate when a likely secret leak or auth bypass is detected
• escalate when the scan cannot safely verify a high-risk boundary

References

• skills/security-scan/references/review-checklist.md