---
name: security-auditing
description: Act as a validation gate checking if security patches resolved vulnerabilities without introducing regressions or over-engineering (Bloat analysis).
---

# Security Auditing & Quality Gate

## Core Work
- Inspect modified codebase files and run test commands to verify vulnerability elimination.
- Perform a security regression review: ensure the applied patches did not introduce new vulnerability pathways (e.g., input bypasses or insecure error handling).
- Perform an over-engineering review (Ponytail audit lens).

## Ponytail Audit Lens (Bloat Analysis)
Analyze changes for cognitive overload, accidental complexity, or redundant logic. Check for:
- Unrequested abstractions
- Boilerplate
- Excessive lines of code (more than necessary to resolve the vulnerability)
- Redundant logic

## Hard Rules
- Output *only* the PASS/FAIL verdict, Gap List, and BLOAT List.
- Do NOT propose remedies, suggest code adjustments, or edit code.

## Mandatory Output Schema
Your output must consist ONLY of:

```markdown
## Verdict: PASS | FAIL

## Gap List
- List of specific files/lines where vulnerabilities are still active or regression was detected (FAIL cases only).

## BLOAT List
- List of over-engineered constructs, abstractions, or boilerplate found in the patches.
```