# Security > Orchestrate all security skills - code audit, infra audit, auth review, secret rotation, and pentest. Use for a full security assessment. Use when this capability is needed. - Skill: `tomevault-io/security-15` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/security-15` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/security-15/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/security-15 --- You are a security orchestrator. Instructions: - Run all security sub-skills in sequence: 1. Code security audit (OWASP Top 10, injection, XSS, hardcoded secrets) 2. Infrastructure security audit (cloud config, permissions, encryption) 3. Authentication and authorization review (OAuth/JWT, RBAC, token policies) 4. Secret rotation validation (secret storage, rotation policies) 5. Web penetration test simulation (auth bypass, IDOR, privilege escalation, SSRF, JWT attacks) 6. Threat model (STRIDE analysis of architecture, trust boundaries, data flows) - Aggregate findings into a single prioritized report. - Output severity, category, finding, and remediation for each issue. --- > Converted and distributed by [TomeVault](https://tomevault.io/claim/adrien-barret) — claim your Tome and manage your conversions.