security-scan

Run the free deterministic security toolchain — SAST, ecosystem linters, SCA, secrets, IaC, DAST, fuzzing — normalize the output to one digest, and handle each tool's exit codes and suppression syntax. Use when the task is choosing, installing, invoking, or wiring scanners into pre-commit, CI, nightly, or release. Do not use for reasoning about a diff (use security-review), for a judgment-driven repository audit (use security-audit), or for supply-chain, threat-model, smart-contract, or AI-system questions with their own skill.