[scope] Audit scope
Optional file glob, directory, or `full`. Omit to scan the current project root. Keep it bounded to the relevant trust boundary unless a full-project review is intended.
/ak:security src/auth/ Ctrl K
Quick Ref / Command
Engineer Kit
/ak:security
Threat-model security audit
Threat-model a scope with STRIDE and OWASP, optional red-team personas, severity-ranked findings, credential masking, and iterative fixes when authorized.
01
Resolve scope
02
Run red-team loop when requested
03
Sweep STRIDE
04
Map OWASP
Rule 01
Threat categories are systematic, not vibes
Rule 02
Red-team mode reasons as attackers from four distinct personas
Rule 03
Confirmed Critical and High findings drive fix priority
Rule 04
Credential hygiene applies across every mode and persona
Execution Map
Core lanes from input to output, aligned with the command's real execution path.
01
Start
Input, scope, route
- 1 Resolve scope Expand the provided glob or `full` keyword into an in-scope file list and read the relevant code before analysis.
- 2 Run red-team loop when requested With `--red-team`, iterate through security adversary, supply-chain, insider, and infrastructure attacker personas before the standard sweep.
02
Work
Agent / skill execution
- 3 Sweep STRIDE Evaluate spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege systematically.
- 4 Map OWASP Map validated issues to OWASP Top 10 categories and fill remaining coverage gaps with the checklist reference.
03
Verify
Gate, review, validation
- 5 Audit dependencies Run stack-appropriate audit tooling such as npm audit, pip-audit, govulncheck, or bundle audit.
- 6 Detect and mask secrets Scan for API keys, passwords, tokens, and private keys, then mask credential values before any finding or log output.
04
Close
Report, handoff, artifact
- 7 Rank findings Assign Critical, High, Medium, Low, or Info by exploitability, data breach/RCE risk, impact, and fix urgency.
- 8 Fix iteratively when authorized With `--fix`, sort findings by severity, apply one targeted fix at a time, run a guard, commit, and stop if verification fails.
Syntax, arguments, subcommands
How to invoke the skill: syntax, positional arguments, shared options, then each subcommand with its own syntax and outcome.
Syntax
/ak:security [scope] [--secrets-only] [--deps-only] [--fix] [--red-team] [--iterations N]Arguments
Shared options
--secrets-only Secrets only
Limit the pass to hardcoded credentials, API keys, private keys, and similar secret patterns with local context checks.
/ak:security --secrets-only--deps-only Dependencies only
Limit the pass to supported package-audit tooling for the detected Node.js or Python project. Unavailable tooling is reported as unavailable, not clean.
/ak:security --deps-only--fix Fix findings
Authorize local targeted fixes after the audit. Each successful iteration runs a guard and creates a local commit; it does not authorize push, PR, merge, release, or deployment.
/ak:security src/ --fix --iterations 15--red-team Red-team discovery
Add attacker-persona discovery before the final STRIDE and OWASP sweep: external adversary, supply-chain, insider, and infrastructure perspectives.
/ak:security full --red-team--iterations N Iteration cap
Cap red-team discovery or fix iterations for the selected mode. `N` is user-chosen; no default numeric cap is documented.
/ak:security src/ --red-team --iterations 20Modes / Routes
default Audit only
- Research:
- STRIDE + OWASP + deps + secrets
- Review:
- No persona loop
- Validate:
- Severity-ranked report
--red-team Persona discovery
- Research:
- Four attacker personas before final sweep
- Review:
- External, supply-chain, insider, infrastructure
- Validate:
- TSV log and report
--fix Audit + fix
- Research:
- Findings sorted Critical through Low
- Review:
- No persona loop unless combined with --red-team
- Validate:
- Guard after each targeted fix; stop on failure
--iterations N Bounded loop
- Research:
- Caps red-team discovery or fix iterations
- Review:
- Caps persona discovery when paired with --red-team
- Validate:
- Stops at N iterations
Sample Prompt
Concrete invocations for each flag, subcommand, mode, or route available in the live workflow.
Scoped API audit Recommended
/ak:security src/api/**/*.ts- Use when:
- Use for a scoped STRIDE + OWASP pass before a release or after API data-handling changes.
- Expected:
- Expands the API glob, reads in-scope files, runs STRIDE/OWASP, dependency and secret checks, then returns a severity-ranked report with file-line evidence.
Full red-team discovery
/ak:securityfull--red-team
- Use when:
- Use when attacker-perspective discovery is needed across the full codebase before the final STRIDE/OWASP sweep.
- Expected:
- Runs the four-persona discovery loop, masks credential values in logged evidence, chains persona findings, then fills gaps with the standard security sweep.
Bounded red-team pass
/ak:securitysrc/--red-team--iterations20
- Use when:
- Use when red-team discovery is useful but the persona loop needs a hard iteration cap.
- Expected:
- Caps persona discovery at 20 iterations, validates each finding with file-line proof and attack scenario, then reports remaining STRIDE/OWASP coverage.
Bounded fix loop
/ak:securitysrc/--fix--iterations15
- Use when:
- Use when authorized to remediate audit findings but the fix loop needs a maximum iteration count.
- Expected:
- Sorts findings by severity, applies up to 15 targeted fixes one at a time, runs a guard after each fix, and stops with the failure reason if verification breaks.
Secrets only
/ak:security--secrets-only
- Use when:
- Use when the immediate risk is leaked credentials, API keys, private keys, or hardcoded passwords.
- Expected:
- Searches secret-pattern references, verifies placeholders versus real credentials, redacts evidence, and recommends rotation for real secrets.
Dependencies only
/ak:security--deps-only
- Use when:
- Use when you only need dependency advisory coverage for a Node.js or Python project.
- Expected:
- Runs the applicable package audit, treats unavailable tooling as unavailable rather than clean, and ranks dependency findings by severity.
Handled Scope
- Resolve scope
- Run red-team loop when requested
- Sweep STRIDE
- Map OWASP
- Audit dependencies
- Detect and mask secrets
Artifacts Produced
Security audit report
Pattern
Chat report with severity table; optional security-audit-results.tsv during red-team loops Files scanned, severity counts, STRIDE/OWASP categories, file-line evidence, impact, and fix recommendations.