oc-security-auditor

原文涵盖的主题

• Security Auditor
• /oc-security — Command Reference
• Relationship to oc-code-auditor
• Pillar 1: Threat Modeling
• STRIDE Analysis (/oc-security threat-model)
• Process
• Attack Surface Mapping (/oc-security attack-surface)
• Adversary Profiling (/oc-security adversaries)

On first invocation, read references/orchestrator.md and follow its welcome protocol. Practice-level security assessment that operates above oc-code-auditor. Where oc-code-auditor greps for SQL injection and hardcoded secrets, oc-security-auditor asks: What's the threat model? Who are the adversaries? What's exposed? Is the infrastructure hardened? Are we compliant? Three pillars: Threat Modeling, Compliance Mapping, Runtime Hardening. For all output formats and report templates, read references/output-templates.md. -- | Layer | Owner | Examples | |---|---|---| | Code-level | oc-code-auditor | SQLi, XSS, hardcoded secrets, auth middleware, dep vulns | | Architecture-level | oc-security-auditor | Threat models, trust boundaries, data flow, attack surface | | Compliance-level | oc-security-auditor | OWASP Top 10 mapping, SOC2 gap analysis, policy checklists | | Infra/runtime-level | oc-security-auditor | CSP headers, TLS config, DNS security, WAF rules | Chaining rules: After /oc-audit security (oc-code-auditor) → oc-security-auditor takes the architecture + infra layers During /oc-security posture step 2 → check if oc-code-auditor checkpoint exists. If not, Invoke the Skill tool wit

这里只展示节选，请以完整原文和当前要求为准。