security-scanlisted

# Security scan Use this skill for the adapters-only branch of the unified Code Scanner workflow. Bootstrap the workspace first; then use it when the requested result must be reproducible local scanner evidence rather than AI interpretation. It supports SAST, secret scanning, software-composition analysis, SBOM, and IaC scanners from the plugin allowlist. ## Inputs - The current workspace as an absolute directory path. - Optional permission to create `.mnogovid-code-scanner.json` with `--write`. - Optional permission for network-dependent scanners with `--allow-network`. - Explicit approval for every scanner process that will actually run. ## Scope consent When the user explicitly authorizes scanning the whole project or workspace, discover and plan all relevant allowlisted scanners across the complete current workspace. Do not narrow that scope to selected components unless the user asks to do so. This scope consent is distinct from, and does not replace, approval for profile writing, network access, or every scanner process. Standard scanner exclusions still apply: `.git`, dependency/vendor directories, virtual environments, caches, build artifacts, and prior `.mnogovid` reports are not treated as project source. ## Workflow 1. Call `security_bootstrap` with `createProfile=false`. Ask before creating a missing profile, and stop on an invalid profile. Report available and missing executables; do not install tools. 2. Ask separately about network-dependent scanne