gabrielmoreira security-audit — review code for security issues, report only
1. Collect scope
Identify what to audit (a directory, a diff, a module). Gather it yourself with sys_os_* / git — this is plumbing, not investigation.
2. Dispatch the scanner (purpose: explore / search)
Hand the scanner the scope; it reads source, manifests, history and returns per-finding evidence. Do NOT sprawl across the repo yourself.
3. Synthesize the draft — FINDINGS TEMPLATE (must match orchestrator prompt)
For each finding:
### <Severity>: <short title>
- **Severity**: Critical | High | Medium | Low | Info
- **Location**: file:line
- **Recommendation**: <fix guidance — describe it, never apply it>
- **Confidence**: high | medium | low
4. Cross-vendor review (purpose: review)
Route the draft through the reviewer (codex, different vendor) to confirm true positives and drop false positives. Fold in its verdicts.
5. Deliver
Present the final report. You REPORT; you never edit, patch, or fix code.