Security audit

Skill DominikTobureto/awesome-grok-build/.grok/skills/security-audit

Grok Build resources, reusable .grok/skills, AGENTS.md templates, hooks, prompts, and starter workflows.

Install

npx -y skills add DominikTobureto/awesome-grok-build --skill security-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Use for security review, auth/permission changes, secrets, dependency risk, injection, SSRF, XSS, CSRF, data exposure, unsafe hooks, or supply-chain concerns.

SKILL.md

1.7 KB, as published. Nobody here has run it

Security Audit

Find exploitable paths and prevent unsafe agent changes.

Grok Build Mode

Start in Plan Mode for any fix that touches auth, permissions, crypto, payments, secrets, or infrastructure.
Use subagents for threat tracks:
- authz: object ownership, roles, tenant boundaries.
- input: injection, XSS, SSRF, deserialization, path traversal.
- secrets: env files, logs, tokens, CI config.
- supply-chain: dependencies, hooks, install scripts.
Arena-style validation: require independent agreement for high-severity findings or reproduce with concrete evidence.
Human-in-the-loop: do not run destructive security tooling or exploit production systems.

Workflow

Define assets, trust boundaries, and attacker goal.
Inspect code paths that cross boundaries.
Look for concrete exploitability, not generic fear.
Propose minimal fixes with tests.
Run security-relevant tests or static checks when available.
Summarize residual risk.

Findings

[P1] Title
Asset:
Attack path:
Evidence:
Impact:
Fix:
Test:

Guardrails

Never print secrets.
Do not add dependencies for security scanning without approval.
Do not weaken auth checks to make tests pass.
Treat third-party skills and hooks as untrusted code until reviewed.

Example Prompts

Use security-audit. Review this auth diff for tenant-boundary bypasses and missing regression tests.

Audit `.grok/skills` and hooks for supply-chain or prompt-injection risks before I install them.