security-audit

Run a repository-wide security audit and own the shared doctrine — severity, evidence, triage, suppression, reporting — that the other security skills restate. Use for a deep audit of a whole codebase or a large subsystem, for turning scanner output into evidence-backed findings, and for producing a security report. Do not use for a pull-request diff (use security-review), for running the toolchain alone (use security-scan), or for dependency, CI, threat-model, smart-contract, or AI-system questions that have their own skill.