Auto Security Report — Single Unit Analyze ONE unit of work — a PR (open or merged), a spec, or a branch diff — for security issues. The analysis is intentionally paranoid: the OWASP Top 10 baseline first, then the non-obvious vectors a conventional review misses, then a sweep for the same pattern elsewhere, and finally concrete Next steps — go deeper runs of this same skill. The unit under analysis is read-only : this skill never comments on, labels, claims, or pushes to the target. Its output is a report — shipped as a docs-only PR through , kept local, or written as a fragment for the driv…