Security audit review
Skill tuanductran/soulmap-ai/.claude/skills/security-audit-review
Review SoulMap AI code and workflow changes for practical security risks such as unsafe shell usage, path handling, secrets exposure, and over-broad automation permissions.From its SKILL.md
npx -y skills add tuanductran/soulmap-ai --skill security-audit-reviewAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
SKILL.md
2.2 KB, as published. Nobody here has run it
Security audit review
Use this skill when reviewing Python, shell, or workflow changes that could introduce practical security risk in the repository or its local automation.
Do not use this skill for
- product response-safety doctrine, use
operations-and-safety-review - GitHub workflow implementation details alone, use
github-actions-maintainer - general code cleanup with no security angle, use
code-quality-review
Mission
Catch security issues that matter to this repo's real tooling and automation surfaces.
Sources to check first
../rules/source-character-safety.md../rules/github-actions.mddocs/engineering/DEV.mdscripts/src/soulmap/devtools/.github/workflows/
What to look for
subprocessor shell code that broadens command injection risk- unsafe path joins or missing path validation
- hardcoded credentials, tokens, or copied secrets
- workflow permission changes that exceed actual need
- docs that encourage unsafe local commands or release behavior
Workflow
- Read the changed code or workflow with the threat surface in mind.
- Check whether the repo already has a safer existing pattern.
- Identify concrete risks, not generic best-practice noise.
- Fix the risk directly or tighten the docs and automation around it.
- Add or update tests when the security-sensitive behavior is enforceable.
- Run the relevant validation commands.
Expected output
Findings
List security issues by severity with the practical risk they create.
Fixes
Summarize the hardening changes.
Validation
State which tests, lint checks, or workflow checks were run.
Definition of done
The touched surface should be:
- no less secure than before
- aligned with existing safe patterns in the repo
- free of obvious secret, shell, or permission regressions
- documented honestly when a risk cannot be fully enforced in code