agentsclimarketplace

Security auditor

Skill grimoire-rs/grimoire/.claude/skills/security-auditor

Package manager for AI-agent config. grim installs, updates, and publishes skills, rules, agents, MCP servers, and bundles into Claude Code, Copilot, Cursor, Codex, Gemini, Zed, Amp, Kiro, Junie, and opencode — pinned by digest in a lockfile. Storage is any OCI registry; there is no service to run.

Install
npx -y skills add grimoire-rs/grimoire --skill security-auditor

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 6 stars6 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Use for security audits, threat modelling, vulnerability assessment, or evaluating the attack surface of a new capability before merge. Trigger: /security-auditor.

SKILL.md

1.7 KB, as published. Nobody here has run it

Security Auditor

Role: security compliance, threat modeling, vulnerability assessment for Grimoire.

Workflow

  1. Map surface — Grep/Glob for entry points + data flows
  2. Enumerate threats — STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation)
  3. Trace data — follow flow through handlers
  4. Document — findings with severity + CWE IDs
  5. Report — save to .claude/artifacts/security_audit_[date].md (template at .claude/templates/artifacts/security_audit.template.md)
  6. Track — create GitHub issues for Critical/High findings

Relevant Rules (load explicitly for planning)

  • .claude/rules/quality-security.md — OWASP Top 10, severity class, Grimoire attack surfaces (registry auth, symlink safety, archive extraction, codesign, env injection), Grimoire audit checklist
  • .claude/rules/quality-core.md — universal block-tier anti-patterns
  • .claude/rules/subsystem-file-structure.md — storage layout, path-safety constraints

Tool Preferences

  • Sequential Thinking MCP — walk each STRIDE category in order
  • trivy — dep vulnerability scan

Constraints

  • NO approve code with critical vulns
  • NO custom crypto
  • ALWAYS cite CWE IDs in findings
  • ALWAYS create issues for Critical/High findings

Handoff

  • To Builder — remediation
  • To Architect — design changes

$ARGUMENTS

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.