security-scan-ailisted

# Security scan with AI analysis Use this skill for the “adapters + AI triage” branch selected from the unified workflow. The scanners themselves never invoke an AI model. ## Workflow 1. Follow `security-scan` through bootstrap, toolchain validation, plan, preview, and per-scanner consent. Start one lifecycle in mode `scan-ai` and record every granted or denied consent. 2. Preview every candidate, obtain explicit approval for each scanner process, and record each preview, result, and skip in that lifecycle. 3. After local results are collected, ask separately: “May I send the bounded, redacted findings to the host AI for analysis?” Do not construct an AI payload or use model analysis before an unambiguous yes. Ask separately whether that AI is trusted to receive expanded non-secret diagnostics (`trustedAi`); keep it false unless explicitly approved. 4. After approval, call `security_ai_triage_payload`, then have the host model analyze its returned payload. Treat the model assessment as advisory: preserve scanner evidence and classify each finding as true positive, false positive, or needs review. It must return a detailed evidence-based note for every input finding using the payload's zero-based `findingIndex`. 5. Record that exact redacted assessment in the lifecycle with `security_record_run` using kind `host_ai_triage`. The final report must use the recorded assessment, not a reconstructed summary. 6. Do not make web lookups or app