agentsclimarketplace
Sign in

Security audit

Skill aiskillstore/marketplace/skills/applelamps/security-audit

Review security of command execution, tool permissions, and API key handling. Use when user mentions "security review", "audit", "check security", "vulnerabilities", or before deploying to production.From its SKILL.md

Install
npx -y skills add aiskillstore/marketplace --skill security-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.

SKILL.md

1.6 KB, 309 tokens by cl100k_base, as published. Nobody here has run it

Security Audit

Instructions

  1. Command Execution Review (backend/main.py):

    • Check run_terminal_command() for shell injection vulnerabilities
    • Verify timeout is enforced (should be 15 seconds)
    • Look for dangerous command patterns

  2. Tool Permission Review:

    • Verify Chat mode only allows: read_file, web_search
    • Check Agent mode tool restrictions
    • Look for permission bypass vulnerabilities

  3. Secrets Management:

    • Ensure .env is in .gitignore
    • Check no API keys are hardcoded
    • Verify python-dotenv usage for environment variables

  4. WebSocket Security:

    • Check for authentication on /ws endpoint
    • Review message validation
    • Look for injection points in user input

  5. Frontend Security:

    • Check for XSS in markdown rendering
    • Review image upload handling (base64 encoding)
    • Verify no sensitive data in client-side code

  6. Generate report with:

    • Critical issues (immediate action required)
    • Warnings (should fix before production)
    • Recommendations (best practices)

Examples

  • "Run a security audit"
  • "Check for vulnerabilities"
  • "Review security before deploy"

Guardrails

  • This is a READ-ONLY audit; do not modify files
  • Report findings without exploiting vulnerabilities
  • Recommend fixes but get user approval before implementing
  • Never log or expose discovered secrets

What ships with it: 1 file

14.6 KB alongside SKILL.md

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.