Security Orchestrator

When security work is ambiguous, Security Orchestrator determines the single smallest sufficient workflow that should run next. It routes across threat modeling, requirements, review, vulnerability discovery, exploit validation, penetration testing, remediation, implementation, retesting, incident triage, and release gating without forcing every security problem through the same process.

What it does

• Interprets ambiguous AppSec requests before specialist work begins.
• Selects exactly one primary security workflow for the current task.
• Distinguishes design, review, discovery, validation, penetration testing, remediation, implementation, retesting, incident response, and release gating.
• Separates authorization from execution trigger.
• Prevents broad authorization from automatically activating offensive testing.
• Uses the available evidence to determine whether a specialist workflow is justified.
• Routes adjacent work rather than combining unrelated security phases.
• Defines a clear stop condition and handoff to the selected specialist.
• Keeps missing information UNVERIFIED instead of inventing context.

How it works

1. Intent classification determines what security outcome the user is actually requesting.
2. Evidence review identifies what is already known, verified, missing, or still hypothetical.
3. Phase detection determines whether the work belongs to design, review, discovery, validation, active testing, remediation, implementation, retest, triage, or release assessment.
4. Authorization analysis determines whether any active security technique is permitted.
5. Trigger analysis separately determines whether that authorized technique is actually justified by the current evidence and objective.
6. Specialist selection chooses the single smallest sufficient workflow.
7. Stop condition defines when that workflow should end.
8. Handoff identifies what workflow should follow only after the current phase produces the required evidence.

Authorization does not equal trigger

Permission to perform security testing does not mean penetration testing is always the correct next action.

A new system with no threat model may need threat-modeling.

A documented but unproven vulnerability may need exploit-validation.

Broad vulnerability discovery may need vulnerability-assessment.

A confirmed vulnerability that needs a fix plan may need security-remediation-planning.

An approved remediation may need security-fix-implementer.

A release with completed security evidence may need security-release-gate.

The orchestrator selects the workflow justified by the current state, not the most aggressive workflow permitted by the authorization.

Boundaries

This skill routes security work. It does not execute the specialist workflow itself.

It does not perform penetration testing, exploit validation, code review, vulnerability assessment, remediation, implementation, security testing, or release gating on behalf of the selected specialist.

When the correct specialist is already obvious and explicitly requested, use that specialist directly.

Why this beats prompting it yourself

Ambiguous security prompts often cause agents to skip phases, combine discovery with exploitation, treat authorization as permission to escalate immediately, or use a broad security workflow when a narrower one would produce better evidence. Security Orchestrator resolves that ambiguity first and selects one bounded next step with a clear reason and stopping point.

Validation

Routing boundary stress tested in isolated Antigravity sessions. 5/5 targeted high risk negative cases kept this skill OFF with zero false triggers.

At pack level, JetFerrari Security Engineering also passed 58/58 routing integrity checks with zero unresolved cases.

Use cases

• Route ambiguous AppSec work to the correct specialist.
• Decide whether a task needs threat modeling, review, testing, remediation, or release gating.
• Prevent authorized pentest capability from triggering before evidence justifies it.
• Choose between vulnerability assessment and exploit validation.
• Route confirmed findings from verification into remediation planning.
• Determine the correct next security phase after implementation or retesting.

Known limitations

This skill depends on the task context and evidence available to determine the correct route. If the request is underspecified, important facts may remain UNVERIFIED and the selected workflow may require additional evidence before execution. The skill does not execute specialist security work itself and does not grant authorization for offensive activity.

Part of JetFerrari Security Engineering.