security-audit SKILL.md skillA
security-audit from perrylink/dsh-skill-pack-security is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add perrylink/dsh-skill-pack-security/security-audit@v2.2.25Pins v2.2.25 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- perrylink/dsh-skill-pack-security
- Path
skills/security-audit/SKILL.md- Versions recorded
- 13
- Latest version
- v2.2.25, committed Oct 31, 2026
- First version recorded
- Sep 7, 2026
- Size
- 7,134 bytes
- Repository stars
- 22
- License
- Apache-2.0
仓库/软件安全审计总览：范围界定→资产清单→风险分级→逐项验证→报告模板的分阶段流程，按需转调 secret-scan、dependency-audit、supply-chain-review、prompt-injection-review 四个专项技能。用户要求整体审计仓库、规划审计步骤或汇总多类发现出报告时用；只查密钥/依赖等单一主题时直接加载对应专项技能，不用本总览。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# 安全审计总览（security-audit） 本技能编排一次仓库安全审计的完整流程，产出**每条发现都能用一条命令复核**的报告。 它只编排；四类主题的检查细节分别在 `secret-scan`（密钥）、`dependency-audit`（依赖）、`supply-chain-review`（新增依赖评审）、`prompt-injection-review`（agent 项目注入面）中。进入相应阶段时，用 `skill` 工具按需加载对应专项技能，不要在本文件里重写其细节。 ## 自动化预检：plugin_vet 工具 本包 provider 同时注册 `plugin_vet` 工具（license 扫描 / SBOM / commit 锁定 / 恶意模式 / 五维评分）。它只做机器预检，结果中每条 finding 都标注本包对应技能小节，命中后按本技能流程继续人工审计；工具结果 fail 且门禁策略为 deny 时安装被阻断。 ## 阶段 0：固定审计对象（不固定对象，报告不可复现） ```sh git rev-parse --show-toplevel git log -1 --format='%H %cd' --date=iso-strict ``` 预期输出样例（以实际输出为准）： ``` D:\repo\example a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0 2026-08-14T10:30:00+08:00 ``` 判据：`git rev-parse` 退出码为 0 且第一行是绝对路径；非 0 表示不在 git 仓库内，停止并说明原因。 报告元数据必须记录该提交哈希——审阅者据此在任意时刻重放全部检查命令。 确认工具能力（缺哪个，对应专项技能里都有降级路径；不要声称"扫过"未执行的检查）： ```sh gitleaks --version; trivy --version; pnpm --version checkov --version ``` 样例输出：`gitleaks version 8.24.3` / `Version: 0.61.0` / `10.9.0` / `3.2.x`。 判据：每条命令退出码 0 = 可用；非 0 或 `command not found` = 不可用，报告中注明"未执行（工具不可用）"。checkov 不可用不阻塞审计（IaC 面改用 `trivy config` 或降级人工审）。 ## 阶段 1：范围界定 产物：**审计范围清单**——逐条列出纳入审计的文件、目录、依赖与配置路径，并写出排除项及理由。 ```sh git ls-files | wc -l …
Read the whole file at its exact version.
How to install
mdr add perrylink/dsh-skill-pack-security/security-audit@sha256:b3892c0f068f40b5The line at the top of this page pins the label v2.2.25, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_2bkgd2jd3p2hbi6q)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 13 versions of this file, between Sep 7, 2026 and Oct 31, 2026, about one every 5 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| v2.2.25 latest | 2026-10-31 | af6b35f | 7,134 B | A | view · diff |
| v2.2.24 | 2026-10-10 | 0c1deb8 | 7,134 B | A | view · diff |
| v2.2.23 | 2026-10-10 | a5f8d45 | 7,134 B | A | view · diff |
| v2.2.22 | 2026-10-05 | 008bf2e | 7,134 B | A | view · diff |
| v2.2.20 | 2026-10-05 | 6b2adfe | 7,134 B | A | view · diff |
| v2.2.19 | 2026-10-04 | 380880e | 7,134 B | A | view · diff |
| v2.2.18 | 2026-10-04 | 8761f0d | 7,134 B | A | view · diff |
| v2.2.17 | 2026-09-24 | f926448 | 7,134 B | A | view · diff |
| v2.2.16 | 2026-09-12 | 8e74c4d | 7,134 B | A | view · diff |
| v2.2.14 | 2026-09-10 | d6120c8 | 7,134 B | A | view · diff |
| v2.2.13 | 2026-09-09 | 6ffdda7 | 7,134 B | A | view · diff |
| v2.2.12 | 2026-09-09 | dd3da11 | 7,134 B | A | view · diff |
| v2.2.10 | 2026-09-07 | 4430c52 | 7,134 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (7134 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
perrylink/dsh-skill-pack-security · 22 stars · license Apache-2.0 · pushed 2026-11-01 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_2bkgd2jd3p2hbi6q GET https://markdownregistry.com/api/v1/resolve?ref=perrylink/dsh-skill-pack-security/security-audit GET https://markdownregistry.com/api/v1/blob/b3892c0f068f40b52fe1e36733b5954ad73e0761001a29f6043d1a2f02a4b887
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from perrylink/dsh-skill-pack-security
Every file in perrylink/dsh-skill-pack-security