git:20260801.0de5ac7 to git:20261013.fbe187d

+ description: "Application security hub: built-in /security-review plus lanes for OWASP Top 10, secrets, dependency CVEs, prompt-injection defense, CodeQL CI, variant analysis and incident response. Use when asked to audit security, scan for secrets or vulnerable packages, harden an AI app, or handle a breach."

+ - Grep

+ - Glob

+ - Bash

+ - Write

+ - Edit

+ - Skill

+ - Agent

+ argument-hint: "[audit | owasp | secrets | deps | ai | codeql | variants | incident | baseline | release-gate]"

+ model: opus

+ effort: high

+ # /ccc-security — Find, prove, fix vulnerabilities

+ **CC Commander** · /ccc-security · a verified security findings report for the current repository, routed to the right specialist lane.

+ This skill extends Claude Code's built-in `/security-review`; it does not reimplement it. Lane commands and checklists live in [references/lanes.md](references/lanes.md). The user's selected model is preserved; the only tier routing here is the optional `fable` threat-model delegation in step 4.

+ ## When to use / when not to

+ Use for: a security audit or OWASP check, secrets or credential scanning, dependency CVE and license audits, hardening an LLM-powered feature against prompt injection, wiring CodeQL into CI, hunting variants of a known bug, or running an active incident.

+ Not for: infrastructure and SaaS-account hardening before launch (use `/ccc-harden`), general code-quality review (use `/ccc-code-review`), or destructive-command guardrails for the session (use `/ccc-safety`).

+ ## What happens

+ 1. **Pick the lane.** Map `$ARGUMENTS` or the user's words to a lane with the routing matrix in [references/lanes.md](references/lanes.md#routing-matrix). If the intent is an active incident, go straight to step 7 and stop all other work. If there is no clear intent, ask the lane picker (Decision points).

+ 2. **Run the built-in entry scan** for every lane except `incident`:

+ ```

+ Skill: security-review

+ ```

+ Keep its findings as the baseline. If the built-in `/security-review` is unavailable in this runtime (including Codex), note that and start at step 3.

+ 3. **Run the lane.** Read the lane section of [references/lanes.md](references/lanes.md). For the full lane playbook, Glob for `**/skills/ccc-security/<lane>/SKILL.md` (in the Commander repository it is `skills/ccc-security/<lane>/SKILL.md`; in an installed CLI toolkit it sits under the toolkit's `skills/` directory) and Read it; if no match exists, use the lanes.md section alone. Run the lane's exact commands with Bash; detect the toolchain first:

+ ```bash

+ ls package-lock.json pnpm-lock.yaml yarn.lock requirements*.txt pyproject.toml Cargo.lock go.sum 2>/dev/null

+ command -v gitleaks pip-audit cargo-audit gh codeql 2>/dev/null

+ ```

+ When a scanner is missing, use the fallback listed for that lane and record "tool absent" in the report. Installing a scanner needs the user's approval.

+ 4. **Threat model when the scope warrants it.** For a full audit of a non-trivial system, delegate the threat model to the plugin's `security-auditor` agent through the Agent tool with `model: "fable"` and `effort: "high"`, passing the scope from step 1. Use the result to direct the static and dynamic passes. Codex: run the threat model through `codex exec` in a fresh context with the same scope and agent instructions.

+ 5. **Prove before alarm.** For every Critical or High finding, confirm the code path by reading it (`path:line`) or reproducing it. Then hand the Critical/High list to a fresh-context verifier (Agent tool, `security-auditor`, prompted to refute each finding and to default to "refuted" when uncertain). On Codex, run the verifier through a separate `codex exec` so it starts in a fresh context. Keep only findings that survive; list refuted ones separately with the reason.

+ 6. **Fix only with approval.** Offer the fix picker (Decision points). For approved fixes, edit the code, then rerun the lane command that found the issue and the project's test command (read `package.json` scripts or the repo's documented check before running it). Report the before and after output.

+ 7. **Incident mode.** Follow the incident lane in [references/lanes.md](references/lanes.md#8-incident-response--active-security-event): triage, preserve evidence, then propose containment. Ask before each containment action; every one changes external state.

+ 8. **Report.** Return the findings report in the shape under Done when. For CodeQL setup, include the workflow file path and the validation output.

+ ### Campaigns

+ Run these lane sequences when the user picks a campaign (`baseline`, `release-gate`, or `ai`):

+ | Campaign | Sequence |

+ |---|---|

+ | New project baseline | `/security-review` → `secrets-scanner` → `dependency-audit` → `owasp-top-10` → `codeql-integration` |

+ | Pre-release gate | `security-audit` → `owasp-top-10` → `dependency-audit` → `variant-analysis` |

+ | AI app hardening | `prompt-injection-defense` → `security-audit` (extended for AI surfaces) → `owasp-top-10` plus the OWASP Top 10 for LLM Applications |

+

+ Standing defaults: run `secrets-scanner` and `dependency-audit` on every new project, and `owasp-top-10` before every production release.

+

+ ## Decision points

+

+ Lane picker (AskUserQuestion; Codex: ask the same as a plain-text question), shown when intent is unclear:

+

+ - 🟢 **Full audit** — `/security-review` + `security-audit` + `owasp-top-10`; the broadest coverage, slowest.

+ - **Secrets and dependencies** — `secrets-scanner` + `dependency-audit`; fast baseline for a new repo.

+ - **AI app hardening** — prompt-injection campaign; for features that pass untrusted text to a model.

+ - **More** — opens a second picker: CodeQL CI, variant analysis, incident response, pre-release gate.

+

+ Fix picker, after verified findings:

+

+ - 🟢 **Fix Critical and High now** — edits code, then reruns the finding's check and the tests.

+ - **Fix one finding** — the user names it; same verification.

+ - **Report only** — no edits; findings stay in the report.

+

+ Secret-in-history picker, when a live credential is found in git history:

+

+ - 🟢 **Rotate first** — the user rotates the credential at its provider; history cleanup follows.

+ - **Report only** — record it; nothing changes.

+

+ ## Done when

+

+ - The lane's commands ran and their real output (or "tool absent" plus the fallback) is in the report.

+ - Every reported Critical/High finding has `path:line` or a reproduction and survived the fresh-context verifier.

+ - For applied fixes: the originating check and the test command were rerun, and `git status --short` shows only the intended files changed.

+

+ Report shape:

+

+ ```markdown

+ ## Security report — <repo> — <lane or campaign>

+ Scope · tools run · tools absent

+ ### Findings (verified)

+ - [CRITICAL] title — path:line — impact — fix

+ ### Refuted candidates

+ - title — why refuted

+ ### Fixes applied

+ - finding — files — check rerun result

+ ### Next

+ - one recommended next lane

+ ```

+

+ ## Guardrails

+

+ - Never print a secret value; redact to the first four characters. Never write a found secret into a report, commit, or log.

+ - Dynamic tests (curl, scanners against a URL) run only against a target the user owns and names.

+ - Credential rotation, account disabling, IP blocking, history rewrites, force pushes, and disclosure or notification messages each need the user's authorization at that moment, asked with a picker. This skill does not push, deploy, or post.

+ - No `npm audit fix --force`, no package installs, and no CI workflow writes without approval.

+ - A grep hit is a lead, not a finding: confirm it before assigning severity (see [rules/fable-method.md](../../rules/fable-method.md)).

+

+ ## See also

+

+ - `/ccc-harden` — production hardening across hosting, CI and SaaS accounts.

+ - `/ccc-code-review` — general code review of a diff.

+ - `/ccc-ci` — CI pipelines where the CodeQL workflow lands.

+ - `/ccc-safety` — session guardrails for destructive commands.