Agent skill (axguard-security) - AwareXone Docs

Skill name: axguard-security Path in the repo: skills/axguard-security/SKILL.md (installed by ./install.sh). This skill does not implement scanners. It teaches when to call AXguard, which MCP tool to use, and how to read verdicts.

When to call

Call after security-sensitive edits, or before ship/deploy, when changes touch auth, tenants, DB, outbound HTTP, files/commands, uploads, secrets, OAuth, GraphQL, cloud, crypto, dependencies, or AI agent / MCP tools. Skip trivial non-security edits (typos, comments, pure renames with no security surface).

Workflow

Code change
  → security-sensitive?
       NO  → skip
       YES → axguard_security_review
               → findings?
                    YES → axguard_investigate (suspicious)
                        → fix
                        → axguard_verify_fix

Step	Tool
Default entry	`axguard_security_review`
Dig deeper	`axguard_investigate`
After a fix	`axguard_verify_fix`
Debate a finding	`axguard_get_evidence` / `axguard_get_counter_evidence`

Interpret labels

Label	Agent rule
VERIFIED	Do not dismiss without new counter-evidence
UNKNOWN / incomplete	Do not call the change safe
FALSE_POSITIVE	Do not report as a vulnerability
PREDICTIVE_RISK	Risk signal only — not a confirmed vulnerability

Never invent evidence. Prefer MCP when available; fall back to axguard scan . / axguard audit . with the same verdict rules.

Skill	Role
`axguard-security`	MCP-first review / investigate / verify fix
`axguard-preship`	Short release checklist (skill only — not a CLI)
`axguard-audit` / `axguard-triage` / …	Orchestration and domain skills installed with the plugin

See Pre-ship and AI agents.