comprehensive-security-report

Target: $ARGUMENTS

If no target path is given above, review the entire codebase.

Comprehensive Security Report

Start by reading all existing audit files in the audits/ directory (e.g. audits/*.md). These were produced by the individual security audit skills. Synthesize their findings into one consolidated report. If no prior audit files exist, perform a fresh analysis of the target codebase before writing the report.

The consolidated report must include:

Executive Summary

Summarize the overall security posture (Critical/High/Medium/Low), total vulnerability counts by severity, and the top immediate actions required.

Critical Vulnerabilities (Fix Immediately)

List each critical finding with its source audit file, CWE reference if applicable, and affected code locations.

High Priority Issues (Fix within 1 week)

List each high-severity finding with code locations and remediation steps.

Medium Priority Issues (Fix within 1 month)

List each medium-severity finding with recommendations.

Low Priority Issues (Fix in next release)

List low-severity improvements.

Security Recommendations

1. Implementation priorities
2. Security tools to adopt
3. Process improvements
4. Training needs

Compliance Checklist

• OWASP Top 10 coverage
• PCI DSS (if handling payments)
• GDPR (if handling EU data)
• SOC 2 requirements

Testing Guide

Include curl commands or test scripts to verify each fix.

Constraints & style:

Be concrete and cite exact code locations and identifiers from the source audit files or from direct analysis.

Prefer minimal, drop-in fix snippets over prose.

Do not invent files or functions that aren’t present; if context is missing, mark as Unable to verify and say what code would prove it.

Write this into a markdown file and place it in the audits/ folder.