scan-securitylisted

# Security Audit Conduct a Snyk security audit of the current repository: static analysis (SAST) of code, software composition analysis (SCA) of dependencies, remediation of findings the project's verification gates accept, and a prioritized evidence-backed findings report. This skill carries the audit workflow. The project supplies the rest: build / lint / test / install commands, source file conventions, dependency-manager invocations, false-positive patterns, and any hard remediation prohibitions live in the project's context files (AGENTS.md, CLAUDE.md, CONTRIBUTING.md, README.md) and architecture documentation. This skill tells you *how to scan, remediate, and report*; the project tells you *what counts as valid* for fixes. ## Inputs The user invokes this skill with an optional scope argument. Resolve the scope before any tool call. | Scope | SAST target | SCA target | |---|---|---| | `all` (default when unset) | Entire repository | Full dependency manifest set | | `code` | Entire repository | (skipped) | | `deps` | (skipped) | Full dependency manifest set | | `changed` | Source files modified vs. `HEAD` | Manifest / lock files modified vs. `HEAD` | For `changed`, derive the file set from the union of `git diff --name-only HEAD` and `git diff --cached --name-only`, deduplicated. Within that set: - **Source files**: pass the diff list to the SAST tool. Snyk Code skips files in unsupported languages. Filter out obvious non-source (lock files, binary assets, generate