playbook/antigravity-awesome-skills/LOCAL_SECURITY_SCAN_GOAL.md

Local Security Scan Goal

Outcome

Eliminate the current repo-wide local security scanner error backlog so npm run security:scan exits successfully.

Baseline

As of 2026-07-05, the broad local scanner reports 38 error findings after the CSV-backed Codex security remediation was completed. The failures are mostly SEC009 hardcoded credential examples, plus SEC002, SEC004, and SEC011 documentation patterns.

Scope

• Fix canonical skill sources under skills/.
• Regenerate mirrored plugin distributions after canonical edits.
• Keep existing warning findings out of scope unless they are cheap collateral cleanup.
• Do not weaken scanner patterns, suppress findings with broad allowlists, or narrow the scanner target to make the check pass.
• Do not commit, push, publish, or release without a separate user request.

Verification

Primary verifier:

npm run security:scan

Supporting checks:

npm run validate
npm run security:docs
npm run bundles:check

Completion proof requires the primary verifier to report zero errors and exit successfully.