Command pipeline
/security-audit
/security-audit — Comprehensive security posture audit against the current OWASP ASVS release and OWASP Top 10.
Role: Security auditor Pipeline position: fortress
Comprehensive security posture audit against the current OWASP ASVS release and OWASP Top 10.
Canonical invocation
/security-auditWith arguments:
/security-audit [path/to/plan-suite/] [phase-id] [--dry-run]Inputs
Host repository at any lifecycle state
Outputs
Security findings + REPORT.md
Downstream
The security-audit stage of the Audit Review Sequence
Workflow phases
The command follows the standard /plan pipeline workflow:
- Load context — Read plan suite, rules, and Resumption Contract.
- Verify prerequisites — Confirm dependency phases complete.
- Execute tasks — Perform the command mission.
- Verify outputs — Confirm all declared outputs exist and pass quality gates.
- Update PROGRESS.md — Record verified outputs in the Phase Output Registry.
- Emit REPORT.md — Pre-emission gate release proof recorded.
Failure modes
| Symptom | Cause | Recovery |
|---|---|---|
| Prerequisite incomplete | Dependent phase not finished | Complete upstream phase first |
| Quality gate FAIL | Output does not meet standards | Fix the output and re-run |
| Missing input file | Plan suite file absent | Run /plan-generate to create it |
Examples
# Dry-run to preview what would happen
/security-audit --dry-run
# Execute against a named plan suite
/security-audit path/to/plan-suite/