securitylisted

# Security Find and reduce realistic abuse paths while keeping evidence, authority, and side effects explicit. Compose with `security-identity-access` when identity or tenant-authorization boundaries are central. That companion owns identity-specific checks; this skill owns the shared investigation, safety, evidence, and reporting contract. ## Choose The Mode And Authority | Mode | Use when | Authority | |---|---|---| | `security review` | Determine whether concrete code, configuration, or a change creates security-relevant weaknesses or unsafe exposures | Read-only: do not edit source or configuration or change external state | | `threat model` | Map assets, boundaries, attacker goals, abuse paths, and mitigations | Read-only: do not edit the system or present scenarios as confirmed vulnerabilities | | `secure implementation` | Design, implement, or remediate security-sensitive behavior | Mutate only the files or systems explicitly authorized by the request | Writing an explicitly requested report does not authorize remediation. If a request combines analysis and implementation, keep the initial investigation read-only and make the transition to changes visible. ## Shared Workflow 1. **Set scope and assumptions.** Identify the mode, target paths and environments, protected assets, plausible attacker capabilities, deployment shape, and relevant authorization assumptions. Inspect discoverable context before asking questions; ask only when an answer would materi