Security audit
Run a security pass over the project or a change, one concern at a time, and turn findings into TODO tasks. Use before declaring work done, when the user says "/security-audit", "check security", "audit this", "is this safe", or after wiring an integration. Builds the checklist from general application-security concerns plus the per-integration security items from the integrations registry (PCI surface for payments, RLS for Supabase, IAM scope for storage, webhook signatures, secret handling, authz, injection, SSRF). Wraps the bundled security-review where available. Reports findings with severity + evidence; never prints secrets.From its SKILL.md
npx -y skills add gabrieldabbah/genesis --skill security-auditAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- reads credentialsReads from 1 credential source: `.env`.
- 4 stars4 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its file declares
Copied from the file, not written here
The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
2.8 KB, 494 tokens by cl100k_base, as published. Nobody here has run it
Security audit — concern by concern, findings → tasks
Operationalize "check securities one by one, then update the TODO." Be concrete and evidence-based; a finding without a file:line and a why is not a finding.
Procedure
- Build the checklist. Start from the baseline below, then add the per-integration items from each
enabled service's registry entry (
security:field). Tailor depth to archetype (deeper threat-modeling for anything network-facing; data-integrity for pipelines; PCI surface for payments). - Run the bundled review. If
/security-reviewis available, run it over the diff/branch and fold its output in. Optionally dispatch thesecauditworker for a second, independent pass. - Go one concern at a time (don't blur them):
- Secrets — no keys/tokens in code, logs, or git history;
.envgit-ignored;.env.examplenames only; Read/denyRead rules cover secret paths. - AuthN/AuthZ — every protected route/resource checks identity and permission; no IDOR.
- Input handling — injection (SQL/command/template), validation at trust boundaries, output encoding.
- SSRF / network — outbound calls restricted; no user-controlled URLs hitting internal hosts.
- Data at rest / in transit — TLS; least-privilege DB/IAM; PII minimized; backups not world-readable.
- Dependencies — both-ends advisory check via the
sourcesskill; no abandoned/typosquatted packages. - Webhooks / callbacks — signature verification; replay protection.
- Per-integration — the registry
security:items for each enabled service.
- Secrets — no keys/tokens in code, logs, or git history;
- Report each finding as
{severity: critical|high|medium|low, file:line, what, why, fix}with evidence. - Update the TODO — turn every actionable finding into a TODO item (with a
→ verify:), via thetodoskill. Criticals/highs block "done" (the overlord must not mark acceptance green with an open high).
Never print a secret you find — report its location and that it must be rotated/removed, not its value.
What ships with it
Read from the repository
Just SKILL.md. No reference files, no scripts.