agentsclimarketplace
Sign in

Security audit

Skill K95M65/AI_ONBOARD/skills/security-audit

Systematically audit a codebase or system for security vulnerabilities against a threat model. Use when reviewing a whole codebase or feature (your own pre-release code or an unfamiliar external/client project) for security issues — not a single diff.From its SKILL.md

Install
npx -y skills add K95M65/AI_ONBOARD --skill security-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • 24 days oldThe repository was created 24 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.1 KB, 456 tokens by cl100k_base, as published. Nobody here has run it

Security audit

Codebase-agnostic — assume you may be seeing this code for the first time. Works for a pre-release pass on your own code and for an unfamiliar external/client codebase.

For a single diff, the security-review subagent is the lighter tool. Use this skill for a whole codebase, service, or feature.

Method

  1. Orient — map the attack surface fast. Entry points (HTTP routes, CLI args, queue/message consumers, webhooks), trust boundaries, data stores, secrets, outbound calls, and the auth flow. Run bash scripts/surface-scan.sh [path] to grep for common risk indicators and get a starting map. Read the nearest AGENTS.md for context if one exists.
  2. Threat-model. For each entry point: who can reach it, what can they influence, what's the worst outcome? List the assets worth protecting (PII, credentials, money, infra access).
  3. Review by category. Walk reference.md — authn/authz, input validation, injection, secrets, crypto/TLS, data exposure, deserialization, dependencies, config — plus whatever the stack makes most likely.
  4. Confirm. Trace each candidate finding to a concrete exploit path in the code. Mark suspicions you can't trace as "plausible, needs confirmation" — don't assert what you haven't traced.
  5. Report. One finding per issue, highest severity first, using the severity rubric and report format in reference.md: severity, file:line, exploit scenario, fix.

Rules

  • Confirmed over comprehensive — one traced Critical beats ten vague "considers".
  • Severity = impact × exploitability, per the rubric — not gut feel.
  • Read and report only. Never run a found exploit against a live system or exfiltrate data.
  • The root AGENTS.md holds the always-on rules (e.g. never log secrets) — flag violations against them.

What ships with it: 2 files

6.5 KB alongside SKILL.md, 1 of them executable

scripts/

Keep looking

Skills are one crate of 326,834. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.