{"id":78845,"plugin_id":"plugins_6ab4313dbfa08191ae3aa86c67c57b96","kind":"skill","collection_source":"plugin_package","comparison_source":null,"observed_at":"2026-11-03T18:49:31.784Z","digest":"71ff78c320ecf27f5c6267ca1d47f7120bcc4df7a991eee0ecec5bfb1b009d2f","against":null,"payload":{"description":"Apply a bounded, authorized web security and privacy release review.","included_files":[],"name":"audit-security-privacy","skill_md_contents":"---\nname: audit-security-privacy\ndescription: Apply a bounded, authorized web security and privacy release review.\n---\n\n# Audit Security Privacy\n\n**Use when:** The user requests assessment of auth, authorization, session cookies, uploads, input handling, secrets, privacy or supply chain.\n\n## Workflow\n1. Confirm ownership/authorization before active security testing; otherwise limit to defensive code/evidence review.\n2. Map data flows, roles/tenants, origins, user-controlled inputs, stored secrets and sensitive actions.\n3. Inspect server-side authorization, session attributes, CSRF, redirects, SSRF pathways, uploads, CORS, XSS defenses and API abuse controls where relevant.\n4. Select applicable OWASP ASVS/WSTG categories; do not apply giant generic scan requirements to unrelated code.\n5. Review privacy disclosures, collection minimization, retention, provider processing and error/log redaction against actual code.\n6. Separate observed vulnerability from missing verification; treat critical auth bypass or data exposure as blockers and document remediation.\n\n## Non-negotiable checks\n- No unauthorized exploitation or probing of third-party production systems.\n- No destructive auth/privacy probes without a controlled test environment and explicit consent.\n\n## Deliverable\nThreat summary, prioritized findings, affected boundaries, proof/evidence and verification steps.\n\n## References\n- Read `../../references/security-privacy.md` when relevant.\n- Read `../../references/severity-and-triage.md` when relevant.\n\nOnly claim tests, browser access, scans, deployments or specialist execution supported by actual tool evidence. Retain original user constraints and avoid unsolicited code changes.\n"},"changes":[],"summary":"First saved snapshot. No earlier version is available for comparison.","summary_kind":"deterministic","summary_metadata":{}}