A library of focused audit skills for AI coding agents. Each skill is a small, self-contained playbook that an agent can run against a real codebase and report concrete findings with file paths, line numbers, impact, and suggested fixes.
These skills are intentionally general. They are not tied to a specific agent product, package registry, or command system.
| Skill | Purpose |
|---|---|
audit-input-validation |
|
| Audit client and server validation for user-controlled input. | |
audit-auth-and-access-control |
|
| Audit auth flows, sessions, roles, admin routes, and cross-user data isolation. | |
audit-secrets-and-config |
|
| Audit hardcoded secrets, env validation, and webhook signatures. | |
audit-rate-limiting |
|
| Audit API route rate-limit coverage and policy fit. | |
audit-cors |
|
| Audit CORS configuration and origin allowlists. | |
audit-database-performance |
|
| Audit indexes, pagination, unbounded queries, and connection pool risks. | |
audit-resilience-and-observability |
|
| Audit error boundaries, external IO, health checks, logs, and backups. | |
audit-asset-pipeline |
|
| Audit uploads, local file storage, CDN/object storage, and asset delivery. | |
audit-type-safety |
|
| Audit TypeScript type-safety bypasses and unchecked external data. | |
security-review |
|
| Run an umbrella security review that composes the focused web skills. | |
ios-prelaunch-checklist |
|
| Audit iOS App Store assets, technical setup, legal readiness, and signing. |
Clone this repository and point your agent runtime at the skills/
directory, or copy individual skill folders into the skill directory used by your agent.
git clone <repo-url> audit-skills
Each skill lives at:
skills/<skill-name>/SKILL.md
If your agent supports explicit skill paths, invoke a skill by naming the folder or passing the path to its SKILL.md
.
Ask your agent to use one focused skill for a narrow audit:
Use audit-input-validation to audit this repository's forms and API endpoints.
Use security-review
when you want a broad prelaunch pass:
Use security-review to audit this web app before launch.
The expected output is not a generic checklist. A useful run should include:
- Files and line numbers.
- Concrete impact.
- Suggested fixes that match the codebase.
- Missing tests or tests added as reviewable diffs.
- Areas inspected and any areas that could not be verified.
Keep each skill narrowly scoped and self-contained. Add resources only when they directly help the skill run better. Prefer actionable audit instructions over background explanation.
Before publishing changes, check that every skill has valid frontmatter:
ruby -ryaml -e 'Dir["skills/*/SKILL.md"].each { |p| YAML.safe_load(File.read(p).split(/^---\s*$/, 3)[1]); puts p }'