# Security Audit

> Adversarial, authorized red-team / penetration-testing loop for a PHP backend you own — fans out one security-auditor subagent per OWASP/vuln family in parallel, each attacking the RUNNING service (black-box HTTP/GraphQL probing) AND inspecting source (SAST/taint, dependency, secret, config), verifies every candidate by reproducing it against the running service (no false positives), maps it to CWE + OWASP id + CVSS-ish severity, then drives root-cause, suppression-free fixes through php-implementer with a regression test per fix and re-dispatches only still-open families until a clean pass. Use when red-teaming, security-auditing, penetration-testing, vuln-hunting, or threat-modeling an authorized PHP backend, or when /sdlc-review triages the security lens. Defensive/authorized use only — probe ONLY the profile-resolved local service. Skip dynamic probing with a note when capabilities.dynamicsecuritytesting is false or make.start is null (static/SAST lanes still run).

## Facts
- Page: https://tashan.sh/capability/skill-vilnacrm-org-security-audit
- tashan id: skill:VilnaCRM-Org/security-audit
- Source: https://github.com/VilnaCRM-Org/claude-plugins
- Type: skill
- Category: security
- tashan score: 50.0 / 100
- Adoption: 17.0
- Upkeep: 95.0
- Freshness: 90.0
- Evidence coverage: 84% of the inputs this score can use
- Health: active
- Instruction depth: not yet graded
- Official: no

## Install

```sh
cp -r security-audit ~/.claude/skills/
```

## Security audit
Not scanned. We audit npm-published capabilities; this one has no npm package we can resolve, or has not reached the queue. This is not a clean bill of health.

---
Measured 2026-08-20 by tashan (https://tashan.sh) from public evidence. Scorer s5.