Security observability auditor

Enterprise-Grade Guardrails, Zero-Assumption Execution, and Quality Gates for Autonomous AI Coding Agents.

Install

npx -y skills add rafaelghif/antigravity-agents --skill security-observability-auditor

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
3 stars3 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

Copied from the file, not written here

Code scanner for secrets, SAST, structured logging, and metrics verification.

3.0 KB, 692 tokens by cl100k_base, as published. Nobody here has run it

Enforces the Security and Observability Baselines defined in AGENTS.md.

BEFORE creating a PR (git-workflow step 5).
During PR reviews for implementation changes.
Skip Condition: If this is a hotfix/ (SLA <2hr), you MUST still run the security audit, but you may skip non-critical observability refactors.

Check if gitleaks is available. If not, fallback to executing via npx gitleaks.
Ensure ALL environment variables are documented in .agents/brain/env-required.json (Schema: { "VAR_NAME": { "required": true, "secret": true, "description": "..." } }) and accessed via process.env (or equivalent), not hardcoded. Validate all required vars are present before execution.

Check cache .agents/brain/sast-<date>.json before running. Skip if no new code changes.
Execute the primary SAST tool by language:
- Before running SAST, verify each tool is available (via which or npx). If missing, ask the user to install or proceed with fallback (semgrep always available via npx).
- JS/TS: eslint-plugin-security, npm audit
- Python: bandit, safety
- Go: gosec
- Java: spotbugs
- Fallback: semgrep
Check for common vulnerabilities and ensure input sanitization.

Verify the presence of structured JSON logging (check for winston, pino, etc., and verify DEBUG vs PRODUCTION env vars).
Ensure ALL logs across all skill executions and application code output a trace_id for request correlation (see .agents/common/utils.md).
Check that application metrics (/metrics) are exposed and updated correctly. Grep for logger.error or equivalent; verify that process.env.NODE_ENV === 'production' conditionally omits stack property, OR recommend using a logging library that automatically differentiates environments (e.g., pino with redact).

Run npm audit (Node.js), pip-audit (Python), cargo audit (Rust), or dependency-check (Java).
If any vulnerability with CVSS ≥ 7.0 found → block PR.
If CVSS 4.0-6.9 → create technical debt ticket.
Cache results in .agents/brain/deps-audit-<date>.json.

If any secrets are found, immediately halt, use git reset, and escalate.
If SAST or Observability checks fail, refactor the code to comply before proceeding. Remediation Timebox: If remediation takes > config.json -> timeouts.remediation_timebox_minutes, escalate to user and document in .agents/incidents/security-<date>.md.
Record the audit results in .agents/brain/sast-<date>.json.