Security Setup Coordinator

Purpose & Scope

• Coordinate secret scanning (ln-761) and dependency vulnerability audit (ln-625)
• Aggregate findings from both workers into unified report
• Generate security infrastructure: SECURITY.md, pre-commit hooks, CI workflow
• Provide overall security score and risk assessment

When to Use

• During project bootstrap (invoked by ln-700-project-bootstrap)
• Manual security audit request
• CI/CD pipeline initialization

Workflow

Phase 1: Pre-flight Check

• Identify primary ecosystem(s): Node.js, .NET, Python, Go, etc.
• Check for existing security configs (

  .gitleaks.toml

  ,

  SECURITY.md

  )

• Verify gitleaks/trufflehog available for secret scanning
• Verify ecosystem-specific audit tools available
• Log warnings for missing tools (do not fail)

• If

  .gitleaks.toml

  exists: note for preservation
• If

  SECURITY.md

  exists: note for update (not overwrite)
• If

  .pre-commit-config.yaml

  exists: check for gitleaks hook

Phase 2: Delegate Scans

• Delegate via Task tool
• Receive: findings list, severity summary, remediation guidance

• Delegate via Task tool (can run parallel with Step 1)
• Pass parameter:

  mode=vulnerabilities_only

• Receive: vulnerability list, CVSS scores, fix recommendations

Phase 3: Aggregate Reports

• Merge findings from both workers
• Group by severity (Critical first)
• Calculate overall security score

• Critical findings: flag for immediate attention
• High findings: recommend fix within 48h
• Medium/Low: add to backlog

• Files scanned count
• Secrets found (by severity)
• Vulnerabilities found (by severity)
• Overall pass/warn/fail status

Phase 4: Generate Outputs

• Use template from

  references/security_md_template.md

• If exists: update, preserve custom sections
• If new: generate with placeholders

• If

  .pre-commit-config.yaml

  missing: create from template
• If exists without gitleaks: recommend adding
• Template:

  references/precommit_config_template.yaml

• If

  .github/workflows/security.yml

  missing: create from template
• Template:

  references/ci_workflow_template.yaml

• Include ecosystem-specific audit jobs

• Ensure secret-related patterns present:

  • .env

    ,

    .env.*

    ,

    !.env.example

  • *.pem

    ,

    *.key

• Preserve existing entries

Delegation Pattern

CRITICAL: All delegations use Task tool with

subagent_type: "general-purpose"

for context isolation.

Task(description: "Secret scanning via ln-761",
     prompt: "Execute ln-761-secret-scanner. Read skill from ln-761-secret-scanner/SKILL.md. Project: {projectPath}",
     subagent_type: "general-purpose")

Task(description: "Dependency vulnerability scan via ln-625",
     prompt: "Execute ln-625-dependencies-auditor with mode=vulnerabilities_only. Read skill from ln-625-dependencies-auditor/SKILL.md. Project: {projectPath}. Mode: vulnerabilities_only (only CVE scan, skip outdated/unused checks).",
     subagent_type: "general-purpose")

• ❌ Direct Skill tool invocation without Task wrapper
• ❌ Any execution bypassing subagent context isolation
• ❌ Calling ln-625 without mode parameter (would run full audit)

Definition of Done

• Both workers (ln-761, ln-625) invoked and completed
• Findings aggregated with severity classification
• SECURITY.md created/updated
• Pre-commit hook configured (or recommendation logged)
• CI workflow generated (or recommendation logged)
• .gitignore updated with secret patterns
• Summary report returned to parent orchestrator

Reference Files

references/security_md_template.md

references/precommit_config_template.yaml

references/ci_workflow_template.yaml