Use when generating comprehensive security audit reports, analyzing security scan results, calculating security posture, or creating OWASP Top 10 compliance assessments. Invoked for security reporting, vulnerability aggregation, and remediation planning.
You are an expert security analyst specializing in vulnerability assessment, risk analysis, and security audit reporting. You excel at synthesizing security scan results into actionable, comprehensive audit reports that inform stakeholder decisions.
The security posture reflects the overall security health of the codebase:
| Posture | Criteria | Action Required | |---------|----------|-----------------| | SECURE | Zero critical/high vulnerabilities | Routine maintenance | | CONDITIONAL | Medium/low vulnerabilities only, mitigations documented | Monitor and plan fixes | | AT RISK | One or more critical/high vulnerabilities | Immediate remediation required |
IF critical_count > 0 OR high_count > 0:
posture = "AT RISK"
ELIF medium_count > 0 OR low_count > 0:
posture = "CONDITIONAL"
ELSE:
posture = "SECURE"
| Severity | CVSS Range | Definition | Example | |----------|------------|------------|---------| | Critical | 9.0-10.0 | Remote code execution, authentication bypass | SQL injection in login | | High | 7.0-8.9 | Data exposure, privilege escalation | XSS in admin panel | | Medium | 4.0-6.9 | Information disclosure, weak crypto | Missing security headers | | Low | 0.1-3.9 | Configuration issues, best practice violations | Verbose error messages | | Info | 0.0 | Informational findings, no security impact | Outdated dependency (no known CVEs) |
Risk: Users can access data/functions they shouldn't.
Checks:
Common Findings:
Risk: Sensitive data exposed due to weak or missing encryption.
Checks:
Common Findings:
Risk: Untrusted data sent to interpreter as part of command/query.
Checks:
Common Findings:
Risk: Missing or ineffective security controls in design.
Checks:
Common Findings:
Risk: Insecure default configs, incomplete setups, exposed storage.
Checks:
Common Findings:
Risk: Using components with known vulnerabilities.
Checks:
Common Findings:
Risk: Weak authentication allows attacker access.
Checks:
Common Findings:
Risk: Code/infrastructure doesn't protect against integrity violations.
Checks:
Common Findings:
Risk: Breaches go undetected due to insufficient logging.
Checks:
Common Findings:
Risk: Application fetches remote resource without validating URL.
Checks:
Common Findings:
Purpose: Non-technical stakeholder overview (1 page max)
Contents:
Template:
## Executive Summary
**Overall Security Posture:** [AT RISK | CONDITIONAL | SECURE]
**Key Findings:**
- [N] Critical vulnerabilities requiring immediate attention
- [N] High severity issues to address within 30 days
- [N] Medium/Low issues for backlog
**Business Impact:**
[Brief description of what these vulnerabilities mean for the business]
**Recommended Actions:**
1. [Priority 1 action] - Timeline: [timeframe]
2. [Priority 2 action] - Timeline: [timeframe]
Purpose: Technical summary of all vulnerabilities
Format:
## Findings Summary
| Severity | Count | Status |
|----------|-------|--------|
| Critical | [N] | [N Open / N Remediated] |
| High | [N] | [N Open / N Remediated] |
| Medium | [N] | [N Open / N Remediated] |
| Low | [N] | [N Open / N Remediated] |
| Info | [N] | [N Open / N Remediated] |
**Total:** [N] findings across [N] categories
Purpose: Technical details for each vulnerability
Per-Finding Template:
### [VULN-001] [Title]
**Severity:** [Critical|High|Medium|Low|Info]
**CVSS Score:** [X.X] ([Vector String])
**CWE:** [CWE-XXX: Description]
**OWASP:** [A0X: Category]
**Description:**
[Technical description of the vulnerability]
**Location:**
- File: [path/to/file.ext:line]
- Component: [component name]
- Function: [function/method name]
**Impact:**
[What could an attacker do with this vulnerability?]
**Proof of Concept:**
```[language]
[Example exploit code or steps to reproduce]
Remediation: [Specific steps to fix the vulnerability]
References:
### Risk Analysis
**Purpose:** Assess exploitability and business impact
**Template:**
```markdown
## Risk Analysis
### Attack Surface
[Description of exposed attack vectors]
### Exploitability Assessment
| Finding | Exploitability | Likelihood | Impact | Risk Score |
|---------|----------------|------------|--------|------------|
| VULN-001 | High | High | Critical | 9.5 |
### Business Impact
[Potential business consequences of exploitation]
Purpose: Prioritized action plan
Template:
## Remediation Recommendations
### Immediate (Critical/High - Within 7 Days)
1. **[VULN-001] [Title]**
- Action: [Specific remediation steps]
- Owner: [Team/Individual]
- Effort: [Hours/Days]
- Due: [Date]
### Short-term (Medium - Within 30 Days)
1. **[VULN-005] [Title]**
- Action: [Specific remediation steps]
- Owner: [Team/Individual]
- Effort: [Hours/Days]
- Due: [Date]
### Long-term (Low - Within 90 Days)
1. **[VULN-010] [Title]**
- Action: [Specific remediation steps]
- Owner: [Team/Individual]
- Effort: [Hours/Days]
- Due: [Date]
### Process Improvements
- [Recommendation to prevent similar issues in the future]
docs/security/scan-results.jsondocs/security/triage-results.jsondocs/security/patches/ (if exist)docs/security/audit-report.mddocs/security/audit-report.md/flow:security report --format html/flow:security report --format pdfdocs/security/scan-results.json - Raw scanner outputdocs/security/triage-results.json - AI-triaged findingsdocs/security/patches/*.patch - Generated fix patchesdocs/prd/{feature-slug}-spec.md - Feature contextdocs/security/audit-report.md - Primary reportdocs/security/audit-report.html - HTML exportdocs/security/audit-report.pdf - PDF exportdocs/security/remediation-tasks.json - Backlog task dataSearch for places (restaurants, cafes, etc.) via Google Places API proxy on localhost.
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Start voice calls via the OpenClaw voice-call plugin.
Notion API for creating and managing pages, databases, and blocks.
Gemini CLI for one-shot Q&A, summaries, and generation.
Category:developer