/security--security-audit

Reviews your changed files or the ones you name, rating issues in correctness, security, performance and maintainability by severity with fix suggestions.

Reads a file and writes unit tests covering normal use, edge cases and errors in your existing framework, then runs them to check they pass.

Analyzes your staged changes and writes a Conventional Commits message, then creates the commit once you approve it.

Builds a pull request from your commits and diff, with a title, summary, test plan and labels, pushes the branch and returns the PR URL.

Scans your code, config files and recent git history for API keys, tokens, passwords and private keys, and explains how to remediate each.

Runs your package manager's audit and lists each vulnerable dependency with its CVE, severity, fixed version and a remediation plan.

Analyzes your repo's architecture and writes threat-model.md with a data-flow diagram, rated STRIDE threats and a top-5 action list.

Sets up consumer-driven contract tests (Pact by default) so breakages between services are caught at build time without running both together.

Sets up load tests with k6, Locust or Artillery: realistic scenarios, pass/fail thresholds and a lightweight smoke gate in CI.

Sets up mutation testing to measure whether your tests would catch real bugs, then turns surviving mutants into stronger tests.

Drives a real browser through Playwright MCP to navigate, click, fill forms, debug pages and take screenshots.

Reviews failing test snapshots and decides whether each is an intended change, a real bug or a flaky test before updating anything.