Hussh Security Audit Skill

Purpose and Trigger

• Primary scope: security-audit-intake
• Trigger on IAM, consent, trust, ordinary vault encryption, PKM storage or manifest persistence, encrypted PKM records, plaintext localStorage leaks, verification, streaming, and audit-oriented requests where no narrower spoke owns the change.
• Avoid overlap with backend, repo-operations, and repo-context.

Coverage and Ownership

• Role: owner
• Owner family: security-audit

Owned repo surfaces:

1. docs/reference/iam
2. docs/reference/streaming
3. hushh-webapp/lib/consent
4. hushh-webapp/lib/vault
5. hushh-webapp/lib/pkm
6. hushh-webapp/lib/personal-knowledge-model
7. consent-protocol/hushh_mcp/consent
8. consent-protocol/hushh_mcp/trust
9. consent-protocol/hushh_mcp/vault

Non-owned surfaces:

1. backend
2. repo-operations
3. docs-governance

Do Use

1. Broad trust-boundary and audit intake before the correct spoke is clear.
2. IAM, consent, vault, PKM, streaming-safety, and verification questions spanning docs and code.
3. Owning ordinary vault/PKM persistence and choosing when work belongs to IAM/consent, reviewer/BYOK testing, PKM upgrade rehearsal, quality contracts, or streaming contracts.

Do Not Use

1. Broad backend runtime work where trust is not the primary boundary.
2. CI/deploy/env parity work that belongs to repo-operations.
3. Broad repo mapping before the domain itself is known.

Read First

1. docs/reference/iam/README.md
2. docs/reference/streaming/README.md
3. docs/project_context_map.md
4. docs/reference/iam/agent-delegation-boundary.md
5. consent-protocol/docs/reference/consent-protocol.md
6. .codex/skills/security-audit/references/anti-rationalization.md
7. consent-protocol/docs/reference/personal-knowledge-model.md

Workflow

1. Identify whether the real ownership surface is IAM/consent, vault/PKM, quality contracts, or streaming contracts.
2. For ordinary vault/PKM changes, preserve memory-only keys, encrypted persistence, manifest authority, revision safety, and cache invalidation.
3. Keep trust-boundary docs aligned with code and verification changes.
4. Route general backend runtime work back to backend when trust is not the primary concern.

Handoff Rules

1. Route consent scopes, actor model, and IAM/runtime gate work to iam-consent-governance.
2. Route reviewer-account BYOK browser proof to reviewer-app-testing.
3. Route zero-loss PKM upgrade acceptance to pkm-upgrade-rehearsal.
4. Route cross-surface test policy to quality-contracts and streaming work to streaming-contracts.
5. If the request begins as a cross-domain scan, start with repo-context.

Required Checks

./bin/hushh docs verify
cd consent-protocol && python3 -m pytest tests/quality -q