Security Audit

Run a thorough, whole-project security audit — fingerprint the application type, map every applicable attack surface, credit what's already mitigated with evidence, identify open vulnerabilities, deliver an inline audit report, and (after one confirmation) file each finding as a scoped, pipeline-ready GitHub issue. Use this skill WHENEVER the user asks for a security assessment of a project as a whole: \"security audit\", \"how secure is this app\", \"find vulnerabilities\", \"map the attack surface\", \"pentest prep\", \"is this safe to launch\", \"harden this app\". This is the whole-codebase, point-in-time audit — distinct from code-review (which checks one diff's security as it ships) and dependency-maintenance (which remediates the dependency graph; this audit covers it as one surface). Strictly read-only: it never fixes code and never runs exploits — remediation flows through the filed issues into the normal plan → PR → review pipeline.