security-fixlisted

# Security Fix Read the latest `security-report.md` and queue focused, human-reviewable tasks for `PR-worthy` findings. Each task fixes one rule — no bundled concerns. Findings are never turned into direct PRs; they always become task-store tasks that `dev-task` (for autonomous tasks) or a human via `/shipwright:hitl` (for credential-rotation tasks) picks up later. **Prerequisites:** Run `/security-scan` first to produce `security-report.md`. > **Task store setup:** This skill pushes findings to the Shipwright task store. If > `SHIPWRIGHT_TASK_STORE_URL` or `SHIPWRIGHT_TASK_STORE_TOKEN` is missing, invoke > `/shipwright:task-store` for setup instructions. --- ## Setup: Parse Arguments Before starting, check for flags: - `--dry-run` — print what tasks would be queued without querying the task store for dedup or writing any tasks - `--rule {id}` — queue only findings of a specific rule ID (e.g., `--rule osv-cve`) > **Note:** Queueing is the only mode. There is no PR mode and no `--queue` flag — every > run queues tasks. `--dry-run` shows a preview and stops without touching the task store. --- ## Step 1: Verify security-report.md Exists 1. Look for `security-report.md` in the project root. 2. If it does not exist, print: ``` No security-report.md found. Run /security-scan first to generate a report. ``` Then stop. 3. Read the report. --- ## Step 2: Rule Classification Table Unlike `entropy-fix`, there is no shared principles file for `security-scan`'