Security audit
Conduct authorized defensive security audits of codebases and web applications. Use for broad appsec review across OWASP, authz, business logic, SSRF, XSS, CSRF, injection, file upload, secrets, logging, and tenant isolation. Produces structured findings with severity, confidence, evidence, and safe remediation guidance.From its SKILL.md
npx -y skills add MuhammedZohaib/patchman --skill security-auditAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
SKILL.md
1.9 KB, 361 tokens by cl100k_base, as published. Nobody here has run it
Security Audit
When to use
Use this skill when the user wants a full security review of a repository, service, or application slice.
Default behavior
- stay in read-first mode unless the user explicitly asks for a patch
- reason from framework and architecture conventions
- flag likely vulnerabilities and insecure defaults
- explain exploitability in safe, non-weaponized language
- ask for missing deployment or authorization context when needed
Coverage map
- broken access control and IDOR
- authentication, session, cookie, token, and reset flaws
- business logic abuse paths
- XSS, CSRF, SSRF, injection, unsafe deserialization
- file upload and document processing risks
- unsafe crypto and secret management
- headers, rate limiting, logging, admin paths, background jobs, webhooks, queues, migrations
- ORM misuse, N+1, authorization-after-fetch, tenant scope gaps
Workflow
- Identify the app surface, trust boundaries, and privileged workflows.
- Map authn/authz, tenant, and data-access patterns.
- Review request handling, storage, jobs, webhooks, and admin paths.
- Prioritize only findings with meaningful evidence.
- Return findings in the standard Patchman format.
Findings format
Title:Severity:Confidence:CWE / OWASP mapping:Affected area:Why this matters:Evidence:Exploitability notes:Recommended fix:Safer example patch:Follow-up checks:
Safety constraints
Refuse requests for unauthorized access, persistence, evasion, credential theft, destructive actions, or exploit weaponization.
What ships with it
Read from the repository
Just SKILL.md. No reference files, no scripts.
Gives 0 of the 12 instructions most audit compliance skills give in 361 tokens
Counted across 960 of the 1,589 authors here whose files we hold, read 2026-09-06
- Read product marketing context before asking questionsin 29 of 960, across 11 files
- Rank findings by severityin 29 of 960, across 22 files
- Generate audit reportin 22 of 960
- Run the audit scriptin 20 of 960, across 19 files
- Generate a prioritized action plan reportin 19 of 960, across 11 files
- Ensure one H1 per pagein 15 of 960, across 5 files
- Ensure sitemap exists and is accessiblein 14 of 960, across 4 files
- Verify alt text on all imagesin 12 of 960, across 3 files
- Determine the audit scope before startingin 12 of 960, across 4 files
- Verify important pages allowed in robots.txtin 11 of 960, across 2 files
- Detect business type from homepage signalsin 11 of 960, across 7 files
- Delegate specialized tasks to subagentsin 11 of 960, across 7 files
Said here and by no other author read
- Stay in read-first mode unless patched
- Reason from framework and architecture conventions
- Flag likely vulnerabilities and insecure defaults
- Explain exploitability in safe language
- Ask for missing deployment context
- Identify the app surface and trust boundaries
Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.