preflight-security-auditlisted

# Preflight Security Audit Run a comprehensive, 360° audit of a codebase before it ships. This skill is the methodology behind the `/audit` command. It defines the passes to run, how to run them without hallucinating findings, the severity rubric, and the report format. ## Core principles 1. **Evidence over suspicion.** Every finding must cite a concrete `file:line` and explain the exploit or failure path. If it cannot be proven from the code, it does not go in the report as a finding — it goes in an "unverified notes" appendix at most. 2. **Trace, don't pattern-match.** Follow untrusted data from its source to its sink. Follow every state-changing operation to its failure paths. Naming a category is not an audit; proving a specific instance is. 3. **Language- and stack-agnostic, but stack-aware.** The passes apply to any language. When the stack is detected (Next.js, Supabase, Stripe, an AI SDK, etc.), apply the stack-specific checks in the reference files. 4. **Verification is a pass, not an afterthought.** Track 6 re-checks every finding and rejects the ones that can't survive scrutiny. Always run it last. 5. **Nothing is changed without approval.** The audit reports and proposes. Fixes are applied only via `/audit-fix` after the user approves specific items. ## How to run an audit When invoked (directly or via `/audit`): 1. **Scope.** Determine the target path (default: current project root). Identify the languages, frameworks, and serv