---
description: Run a security audit and write findings to .vaspera/audit/
argument-hint: "[project-path: defaults to .]"
allowed-tools: Bash, Read, Grep, Glob
---

Run a security audit against the specified project (or current directory).

## Steps

1. **Validate project path**
   - Default to `.` if no argument provided
   - Confirm the path exists and contains code (`package.json`, `go.mod`, `requirements.txt`, etc.)

2. **Run certification scan**
   - Use the `certification_scan` MCP tool if available in session
   - Otherwise: `npx -y -p vaspera vaspera-hardening scan <path>`
   - Auto-detect languages and run appropriate scanners:
     - JavaScript/TypeScript: semgrep, npm-audit, tsc, eslint
     - Python: semgrep, bandit
     - Go: semgrep, gosec
     - Ruby: semgrep, brakeman
     - All: gitleaks (secrets), trivy (containers)

3. **Write findings to stable location**
   - Create `.vaspera/audit/` directory if it doesn't exist
   - Write findings to `.vaspera/audit/{ISO-timestamp}.json`
   - Schema:
     ```json
     {
       "timestamp": "2026-05-29T10:30:00.000Z",
       "project_path": ".",
       "scanners_run": ["semgrep", "npm-audit", "gitleaks"],
       "findings": [...],
       "summary": {
         "total": 42,
         "by_severity": {"critical": 2, "high": 5, "medium": 15, "low": 20},
         "by_scanner": {"semgrep": 30, "npm-audit": 10, "gitleaks": 2}
       },
       "duration_ms": 12345
     }
     ```

4. **Summarize results**
   Present findings as a table:

   | Severity | Count | Top Scanners |
   |----------|-------|--------------|
   | critical | N | semgrep, gitleaks |
   | high | N | npm-audit |
   | medium | N | semgrep |
   | low | N | eslint |

   Then list **top 5 findings** with clickable file references:
   - `[src/auth/login.ts:42](src/auth/login.ts#L42)` — SQL injection (CWE-89)
   - etc.

5. **Provide recommendations**
   - Identify the 3 highest-impact fixes (severity × fixability)
   - Do NOT modify code or open PRs
   - Suggest running `/vaspera-fix-critical` for remediation (future skill)

## Important

- This skill is READ-ONLY — it audits but does not fix
- Findings are written to `.vaspera/audit/` (separate from MCP cache)
- Use this skill for A/B comparison against the `certification_scan` MCP tool