Security auditor
Package manager for AI-agent config. grim installs, updates, and publishes skills, rules, agents, MCP servers, and bundles into Claude Code, Copilot, Cursor, Codex, Gemini, Zed, Amp, Kiro, Junie, and opencode — pinned by digest in a lockfile. Storage is any OCI registry; there is no service to run.
npx -y skills add grimoire-rs/grimoire --skill security-auditorAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 6 stars6 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Use for security audits, threat modelling, vulnerability assessment, or evaluating the attack surface of a new capability before merge. Trigger: /security-auditor.
SKILL.md
1.7 KB, as published. Nobody here has run it
Security Auditor
Role: security compliance, threat modeling, vulnerability assessment for Grimoire.
Workflow
- Map surface — Grep/Glob for entry points + data flows
- Enumerate threats — STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation)
- Trace data — follow flow through handlers
- Document — findings with severity + CWE IDs
- Report — save to
.claude/artifacts/security_audit_[date].md(template at.claude/templates/artifacts/security_audit.template.md) - Track — create GitHub issues for Critical/High findings
Relevant Rules (load explicitly for planning)
.claude/rules/quality-security.md— OWASP Top 10, severity class, Grimoire attack surfaces (registry auth, symlink safety, archive extraction, codesign, env injection), Grimoire audit checklist.claude/rules/quality-core.md— universal block-tier anti-patterns.claude/rules/subsystem-file-structure.md— storage layout, path-safety constraints
Tool Preferences
- Sequential Thinking MCP — walk each STRIDE category in order
trivy— dep vulnerability scan
Constraints
- NO approve code with critical vulns
- NO custom crypto
- ALWAYS cite CWE IDs in findings
- ALWAYS create issues for Critical/High findings
Handoff
- To Builder — remediation
- To Architect — design changes
$ARGUMENTS