GitHub - metacircu1ar/audit · GitHub

/" data-turbo-transient="true" />

Skip to content

Search or jump to...

Search code, repositories, users, issues, pull requests...

-->

Search

Clear

Search syntax tips

Provide feedback

--><br>We read every piece of feedback, and take your input very seriously.

Include my email address so I can be contacted

Cancel

Submit feedback

Saved searches

Use saved searches to filter your results more quickly

-->

Name

Query

To see all available qualifiers, see our documentation.

Cancel

Create saved search

Sign in

/;ref_cta:Sign up;ref_loc:header logged out"}"<br>Sign up

Appearance settings

Resetting focus

You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

{{ message }}

metacircu1ar

audit

Public

Notifications<br>You must be signed in to change notification settings

Fork

Star

main

BranchesTags

Go to file

CodeOpen more actions menu

Folders and files<br>NameNameLast commit message<br>Last commit date<br>Latest commit

History<br>1 Commit<br>1 Commit

skills

skills

.gitignore

.gitignore

LICENSE

LICENSE

README.md

README.md

View all files

Repository files navigation

Audit Skills

A library of focused audit skills for AI coding agents. Each skill is a small, self-contained playbook that an agent can run against a real codebase and report concrete findings with file paths, line numbers, impact, and suggested fixes.

These skills are intentionally general. They are not tied to a specific agent product, package registry, or command system.

Skills

Skill<br>Purpose

audit-input-validation<br>Audit client and server validation for user-controlled input.

audit-auth-and-access-control<br>Audit auth flows, sessions, roles, admin routes, and cross-user data isolation.

audit-secrets-and-config<br>Audit hardcoded secrets, env validation, and webhook signatures.

audit-rate-limiting<br>Audit API route rate-limit coverage and policy fit.

audit-cors<br>Audit CORS configuration and origin allowlists.

audit-database-performance<br>Audit indexes, pagination, unbounded queries, and connection pool risks.

audit-resilience-and-observability<br>Audit error boundaries, external IO, health checks, logs, and backups.

audit-asset-pipeline<br>Audit uploads, local file storage, CDN/object storage, and asset delivery.

audit-type-safety<br>Audit TypeScript type-safety bypasses and unchecked external data.

security-review<br>Run an umbrella security review that composes the focused web skills.

ios-prelaunch-checklist<br>Audit iOS App Store assets, technical setup, legal readiness, and signing.

Install

Clone this repository and point your agent runtime at the skills/ directory, or copy individual skill folders into the skill directory used by your agent.

audit-skills">git clone repo-url> audit-skills

Each skill lives at:

/SKILL.md">skills//SKILL.md

If your agent supports explicit skill paths, invoke a skill by naming the folder or passing the path to its SKILL.md.

Usage

Ask your agent to use one focused skill for a narrow audit:

Use audit-input-validation to audit this repository's forms and API endpoints.

Use security-review when you want a broad prelaunch pass:

Use security-review to audit this web app before launch.

The expected output is not a generic checklist. A useful run should include:

Files and line numbers.

Concrete impact.

Suggested fixes that match the codebase.

Missing tests or tests added as reviewable diffs.

Areas inspected and any areas that could not be verified.

Development

Keep each skill narrowly scoped and self-contained. Add resources only when they directly help the skill run better. Prefer actionable audit instructions over background explanation.

Before publishing changes, check that every skill has valid frontmatter:

ruby -ryaml -e 'Dir["skills/*/SKILL.md"].each { |p| YAML.safe_load(File.read(p).split(/^---\s*$/, 3)[1]); puts p }'

About<br>No description, website, or topics provided.<br>Resources<br>Readme<br>MIT license<br>Activity<br>Stars<br>0 stars<br>Watchers<br>0 watching<br>Forks<br>0 forks<br>Report repository

Releases

Packages

Contributors

You can’t perform that action at this time.