Audit: Skill library for agentic app audit

A new open-source audit skill library for AI coding agents provides 12 self-contained playbooks that agents can run against real codebases to report concrete findings with file paths, line numbers, impact, and suggested fixes. The library includes focused skills such as input validation, authentication, secrets detection, rate limiting, CORS, database performance, resilience, asset pipeline, type safety, a security review umbrella skill, and an iOS prelaunch checklist. Each skill is intentionally general and not tied to any specific agent product or package registry.

A library of focused audit skills for AI coding agents. Each skill is a small, self-contained playbook that an agent can run against a real codebase and report concrete findings with file paths, line numbers, impact, and suggested fixes. These skills are intentionally general. They are not tied to a specific agent product, package registry, or command system. | Skill | Purpose | |---|---| audit-input-validation | Audit client and server validation for user-controlled input. | audit-auth-and-access-control | Audit auth flows, sessions, roles, admin routes, and cross-user data isolation. | audit-secrets-and-config | Audit hardcoded secrets, env validation, and webhook signatures. | audit-rate-limiting | Audit API route rate-limit coverage and policy fit. | audit-cors | Audit CORS configuration and origin allowlists. | audit-database-performance | Audit indexes, pagination, unbounded queries, and connection pool risks. | audit-resilience-and-observability | Audit error boundaries, external IO, health checks, logs, and backups. | audit-asset-pipeline | Audit uploads, local file storage, CDN/object storage, and asset delivery. | audit-type-safety | Audit TypeScript type-safety bypasses and unchecked external data. | security-review | Run an umbrella security review that composes the focused web skills. | ios-prelaunch-checklist | Audit iOS App Store assets, technical setup, legal readiness, and signing. | Clone this repository and point your agent runtime at the skills/ directory, or copy individual skill folders into the skill directory used by your agent. git clone <repo-url audit-skills Each skill lives at: skills/<skill-name /SKILL.md If your agent supports explicit skill paths, invoke a skill by naming the folder or passing the path to its SKILL.md . Ask your agent to use one focused skill for a narrow audit: Use audit-input-validation to audit this repository's forms and API endpoints. Use security-review when you want a broad prelaunch pass: Use security-review to audit this web app before launch. The expected output is not a generic checklist. A useful run should include: - Files and line numbers. - Concrete impact. - Suggested fixes that match the codebase. - Missing tests or tests added as reviewable diffs. - Areas inspected and any areas that could not be verified. Keep each skill narrowly scoped and self-contained. Add resources only when they directly help the skill run better. Prefer actionable audit instructions over background explanation. Before publishing changes, check that every skill has valid frontmatter: ruby -ryaml -e 'Dir "skills/ /SKILL.md" .each { |p| YAML.safe load File.read p .split /^---\s $/, 3 1 ; puts p }'