Esaa Security Audit

This applies event sourcing architecture to security auditing, giving you deterministic, reproducible results across 95 checks in 16 domains. Every finding gets logged to an immutable event store, so you can replay audits and verify that the same repo state produces identical findings. It's designed to prevent hallucination through schema validation and evidence requirements, which matters when you're actually trusting LLM output for security decisions. The PARCER contract system enforces token budgets and decision hygiene on the agents. You get a complete audit trail in `.roadmap/activity.jsonl` and structured reports with CWE/OWASP mappings. Probably overkill for quick scans, but if you need defensible, traceable security audits of AI-generated code or want to integrate automated security checks into a compliance workflow, the event sourcing approach makes sense.

Install to Claude Code

npx -y skills add aradotso/security-skills --skill esaa-security-audit --agent claude-code