Security audit

Skill VJDiPaola/skill-forge/security-audit

Run a Windows supply-chain security audit across npm, pip, pnpm, and editor extensions. Use when the user asks for a supply-chain audit of npm, pip, pnpm packages or editor extensions on Windows.From its SKILL.md

Install

npx -y skills add VJDiPaola/skill-forge --skill security-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

3 things to look at

16 days oldThe repository was created 16 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

3.4 KB, 800 tokens by cl100k_base, as published. Nobody here has run it

Perform a comprehensive supply chain security audit on this Windows machine. Work through all phases and produce a severity-ranked markdown report saved to ~/security-audit-YYYY-MM-DD.md (using today's date).

Phase 1: Software Inventory

Collect and list:

Globally installed npm packages: npm ls -g --depth=0
pip packages: pip list
pnpm globals: pnpm ls -g --depth=0
yarn globals: yarn global list (if installed)
VS Code extensions: code --list-extensions
Cursor extensions: cursor --list-extensions
Node, Python, npm, pnpm, pip versions

Phase 1b: Vulnerability Scanning

Run automated vulnerability scanners and include results in the report:

npm audit signatures â€” verify provenance of installed npm packages
npm audit â€” check for known vulnerabilities in global packages
pip-audit â€” scan pip packages for known CVEs (install with pip install pip-audit if missing)
gh auth status â€” verify GitHub token scopes are minimal (flag if admin:org, delete_repo, or other overly broad scopes are present)

Phase 2: Known-Bad Package Check

Search the web for current IOC lists and cross-reference installed packages against:

Shai-Hulud npm worm and its variants (check Datadog IOC repo, CISA alerts)
Recent PyPI supply chain attacks (TeamPCP/litellm, typosquats)
Compromised VS Code/Cursor extensions
Axios supply chain attack versions
Typosquat patterns for popular packages

Check specifically for:

setup_bun.js or bun_environment.js in npm global node_modules (Shai-Hulud IOC)
Suspicious preinstall/postinstall scripts in global packages
TeamPCP persistence files: ~/.config/sysmon/sysmon.py, ~/.config/systemd/user/sysmon.service, tpcp.tar.gz
Malicious .pth files in Python site-packages (inspect contents for obfuscated code)

Phase 3: Secret Exposure

Check for credential files (report existence only, NEVER print secret values):

~/.npmrc (check for auth tokens)
~/.aws/credentials
~/.git-credentials
~/.env
.env files in project directories under ~/Project_Codespaces (max depth 3)

For each .env found:

List the key names (not values)
Check if the file is in .gitignore
Check if it was ever committed to git history: git log --all --diff-filter=A --name-only --format="" -- .env

Check git config:

git config --global --list for suspicious entries
git config --global core.hooksPath for custom hook paths

Phase 4: Persistence Mechanisms

Enumerate and assess:

Scheduled tasks: Get-ScheduledTask â€” flag any non-Microsoft, non-standard-vendor tasks
Startup entries: Get-CimInstance Win32_StartupCommand
Recently modified files (last 90 days) in %APPDATA%\npm and %LOCALAPPDATA%\Programs

Phase 5: Report Generation

Compile all findings into a markdown report at ~/security-audit-YYYY-MM-DD.md:

Executive summary (1-2 sentences)
Severity-ranked findings: Critical / High / Medium / Info
For each Critical or High finding, provide the exact remediation command
Software inventory table
Secret exposure summary table
Persistence assessment table
Threat intelligence references with links to sources consulted
Recommendations summary ranked by priority

What ships with it: 1 file

241 B alongside SKILL.md

catalog.yaml241 B

Gives 0 of the 12 instructions most audit compliance skills give in 800 tokens

Counted across 937 of the 1,487 authors here whose files we hold, read 2026-08-07

Fetch latest guidelines before each reviewin 43 of 937, across 3 files
Group findings by severityin 43 of 937
Check files against all fetched rulesin 42 of 937, across 2 files
Output findings in terse file:line formatin 41 of 937, across 3 files
Ask user which files to review if none specifiedin 41 of 937, across 3 files
Read specified files or prompt user for filesin 39 of 937, across 1 file
Generate the audit reportin 33 of 937, across 30 files
Assign a severity to every findingin 25 of 937
Run automated accessibility scansin 23 of 937, across 13 files
Output a markdown audit reportin 22 of 937
Map findings to WCAG criteriain 20 of 937, across 10 files
Confirm audit scopein 19 of 937, across 9 files

Said here and by no other author read

collect inventory of global packages and extensions
record node python npm pnpm and pip versions
run vulnerability scanners on installed packages
verify package provenance signatures
verify GitHub token scopes are minimal
cross-reference installed packages against current IOC lists

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.