Security Finding Discovery

Objective

Investigate the proposed code or code changes for technically plausible security vulnerabilities using the threat model as context.

Standard and Deep discovery workers follow their self-contained coordinator prompts; they do not invoke this skill. For an explicit standalone repository-discovery request, apply the relevant checklist below directly to the authorized current source without running the diff-only workflow or starting another scan.

Artifact Resolution

The path references in this skill are the default locations for this phase. If the user explicitly provides a different path for a required input or output, use the user-provided path instead of the corresponding default path referenced in this skill. If a required input is still missing, stop and ask the user for it before continuing. Use the shared scan artifact path conventions in ../../references/scan-artifacts.md.

SECURITY.md Guidance Gate

Read ../../references/security-guidance.md and resolve the applicable policy before inspecting each source file. A delegated file-review worker must do the same before reading its assigned source.