{"slug": "audit-skill-library-for-agentic-app-audit", "title": "Audit: Skill library for agentic app audit", "summary": "A new open-source audit skill library for AI coding agents provides 12 self-contained playbooks that agents can run against real codebases to report concrete findings with file paths, line numbers, impact, and suggested fixes. The library includes focused skills such as input validation, authentication, secrets detection, rate limiting, CORS, database performance, resilience, asset pipeline, type safety, a security review umbrella skill, and an iOS prelaunch checklist. Each skill is intentionally general and not tied to any specific agent product or package registry.", "body_md": "A library of focused audit skills for AI coding agents. Each skill is a small, self-contained playbook that an agent can run against a real codebase and report concrete findings with file paths, line numbers, impact, and suggested fixes.\n\nThese skills are intentionally general. They are not tied to a specific agent product, package registry, or command system.\n\n| Skill | Purpose |\n|---|---|\n`audit-input-validation` |\nAudit client and server validation for user-controlled input. |\n`audit-auth-and-access-control` |\nAudit auth flows, sessions, roles, admin routes, and cross-user data isolation. |\n`audit-secrets-and-config` |\nAudit hardcoded secrets, env validation, and webhook signatures. |\n`audit-rate-limiting` |\nAudit API route rate-limit coverage and policy fit. |\n`audit-cors` |\nAudit CORS configuration and origin allowlists. |\n`audit-database-performance` |\nAudit indexes, pagination, unbounded queries, and connection pool risks. |\n`audit-resilience-and-observability` |\nAudit error boundaries, external IO, health checks, logs, and backups. |\n`audit-asset-pipeline` |\nAudit uploads, local file storage, CDN/object storage, and asset delivery. |\n`audit-type-safety` |\nAudit TypeScript type-safety bypasses and unchecked external data. |\n`security-review` |\nRun an umbrella security review that composes the focused web skills. |\n`ios-prelaunch-checklist` |\nAudit iOS App Store assets, technical setup, legal readiness, and signing. |\n\nClone this repository and point your agent runtime at the `skills/`\n\ndirectory, or copy individual skill folders into the skill directory used by your agent.\n\n```\ngit clone <repo-url> audit-skills\n```\n\nEach skill lives at:\n\n```\nskills/<skill-name>/SKILL.md\n```\n\nIf your agent supports explicit skill paths, invoke a skill by naming the folder or passing the path to its `SKILL.md`\n\n.\n\nAsk your agent to use one focused skill for a narrow audit:\n\n```\nUse audit-input-validation to audit this repository's forms and API endpoints.\n```\n\nUse `security-review`\n\nwhen you want a broad prelaunch pass:\n\n```\nUse security-review to audit this web app before launch.\n```\n\nThe expected output is not a generic checklist. A useful run should include:\n\n- Files and line numbers.\n- Concrete impact.\n- Suggested fixes that match the codebase.\n- Missing tests or tests added as reviewable diffs.\n- Areas inspected and any areas that could not be verified.\n\nKeep each skill narrowly scoped and self-contained. Add resources only when they directly help the skill run better. Prefer actionable audit instructions over background explanation.\n\nBefore publishing changes, check that every skill has valid frontmatter:\n\n```\nruby -ryaml -e 'Dir[\"skills/*/SKILL.md\"].each { |p| YAML.safe_load(File.read(p).split(/^---\\s*$/, 3)[1]); puts p }'\n```\n\n", "url": "https://wpnews.pro/news/audit-skill-library-for-agentic-app-audit", "canonical_source": "https://github.com/metacircu1ar/audit", "published_at": "2026-07-24 08:36:15+00:00", "updated_at": "2026-07-24 08:52:37.348412+00:00", "lang": "en", "topics": ["ai-agents", "developer-tools", "ai-safety"], "entities": [], "alternates": {"html": "https://wpnews.pro/news/audit-skill-library-for-agentic-app-audit", "markdown": "https://wpnews.pro/news/audit-skill-library-for-agentic-app-audit.md", "text": "https://wpnews.pro/news/audit-skill-library-for-agentic-app-audit.txt", "jsonld": "https://wpnews.pro/news/audit-skill-library-for-agentic-app-audit.jsonld"}}