Update to Web App QA & Release Copilot

{
  "description": "Apply a bounded, authorized web security and privacy release review.",
  "included_files": [],
  "name": "audit-security-privacy",
  "skill_md_contents": "---\nname: audit-security-privacy\ndescription: Apply a bounded, authorized web security and privacy release review.\n---\n\n# Audit Security Privacy\n\n**Use when:** The user requests assessment of auth, authorization, session cookies, uploads, input handling, secrets, privacy or supply chain.\n\n## Workflow\n1. Confirm ownership/authorization before active security testing; otherwise limit to defensive code/evidence review.\n2. Map data flows, roles/tenants, origins, user-controlled inputs, stored secrets and sensitive actions.\n3. Inspect server-side authorization, session attributes, CSRF, redirects, SSRF pathways, uploads, CORS, XSS defenses and API abuse controls where relevant.\n4. Select applicable OWASP ASVS/WSTG categories; do not apply giant generic scan requirements to unrelated code.\n5. Review privacy disclosures, collection minimization, retention, provider processing and error/log redaction against actual code.\n6. Separate observed vulnerability from missing verification; treat critical auth bypass or data exposure as blockers and document remediation.\n\n## Non-negotiable checks\n- No unauthorized exploitation or probing of third-party production systems.\n- No destructive auth/privacy probes without a controlled test environment and explicit consent.\n\n## Deliverable\nThreat summary, prioritized findings, affected boundaries, proof/evidence and verification steps.\n\n## References\n- Read `../../references/security-privacy.md` when relevant.\n- Read `../../references/severity-and-triage.md` when relevant.\n\nOnly claim tests, browser access, scans, deployments or specialist execution supported by actual tool evidence. Retain original user constraints and avoid unsolicited code changes.\n"
}