Security & Auditing Skills

Complete end-to-end evaluation of an app/codebase — measures the codebase against the dev-best-practices rules of this repo (essential/app/github/architecture). Axes: Architecture (12-Factor), Security (OWASP ASVS 5.0/Top 10), CI-CD-Delivery (DORA), Code Quality, Tests, Observability. Use this skill whenever the user wants to audit, evaluate, review or assess an entire app or codebase, check production/release readiness, find technical debt, or do a security/architecture review. Trigger also for "evaluate/audit/review my app", "is my app release-ready", "security review", "architecture check" — even if only a single axis is mentioned. If you want to review architecture OR security: use this skill — it covers both. review-arch and review-secure are deep-dives for the respective focus; review-app is the complete overview.

LLM system review grounded in CMU 11-667 (Harms + Attacking LLMs), Berkeley CS294-196 (Safety/Guardrails), and OWASP LLM Top 10. Use this skill whenever the user wants to review an existing LLM-powered system or feature for architecture quality, eval coverage, safety, and production readiness. Triggers: "review my LLM system", "check my RAG", "is my prompt injection safe", "review my agent", "audit my AI feature", "LLM code review", "check my evals", "my RAG is not working properly", "review my LLM setup", "what is wrong with my agent", "LLM audit". Covers: integration pattern assessment, RAG quality, eval coverage, safety/security (OWASP LLM Top 10), production readiness (cost, observability, guardrails). Always use this skill for LLM system reviews.