security-audit SKILL.md skillA

security-audit from uze-sh/uze is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.

mdr add uze-sh/uze/security-audit@git:20261030.539101e

Pins git:20261030.539101e in mdr.lock. Pin the fingerprint instead.

Audit grade

A, 17 of 17 checks passed

Kind

SKILL.md skill

Repository

uze-sh/uze

Path

.agents/skills/security-audit/SKILL.md

Versions recorded

1

Latest version

git:20261030.539101e, committed Oct 30, 2026

Size

6,977 bytes

Repository stars

4

License

Apache-2.0

Offensive security audit of UZE - a red team of agents, each in a bubblewrap sandbox with the operator's home hidden, attacking one surface (acquisition, delivery, extension scripts, workspace and agents, terminal runtime, parsers, distribution) with working exploits, then every finding recorded and fixed as an `audit-<subject>` OpenSpec change that ends in proof. Use when someone asks for a security audit, a pentest, a red team, threat modelling, "procura vulnerabilidade…

Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.

What the file says

# Security audit

UZE runs on the operator's machine, beside the agents it launches, with the
operator's permissions. Every boundary it draws - plugin trust, extension
consent, project-command approval, the pane/operator split, the Rhai engine's
bounds - is a claim an attacker will test. This skill tests them the way an
attacker would: with working exploits against the real binary, in a sandbox
that cannot reach the operator's real home, and it carries what breaks to a
fix that is proven by re-running the same exploit.

It has two halves. **Attack** ends in a findings report. **Fix** turns each
group of findings into an `audit-<subject>` OpenSpec change on the `audit`
schema (`findings → proposal → specs → design → tasks → evidence`) and works
it until `evidence.md` closes every finding.

## Step 1 - scope and baseline

- Record the commit under audit (`git rev-parse HEAD`) and the date.
- Read `references/surface.md`: the attack surfaces, the threat
  actors, what earlier audits found and the defenses that held. A defense
  that held is re-tested only if its code changed since
  (`git log <last-audit-commit>.. -- <paths>`).
…

Read the whole file at its exact version.

How to install

mdr add uze-sh/uze/security-audit@sha256:a39153d3881333a4

[![mdr](https://markdownregistry.com/badge/art_6wwxnycc6ufynncj.svg)](https://markdownregistry.com/a/art_6wwxnycc6ufynncj)

Versions

The registry has recorded 1 version of this file, committed on Oct 30, 2026.

Audit of the latest version

Source

API

GET https://markdownregistry.com/api/v1/artifacts/art_6wwxnycc6ufynncj
GET https://markdownregistry.com/api/v1/resolve?ref=uze-sh/uze/security-audit
GET https://markdownregistry.com/api/v1/blob/a39153d3881333a4d2923ce3afd8220c390b3141c1d5fee42f8481c6e9680459

Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.

Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.

More from uze-sh/uze

Every file in uze-sh/uze

Other files named security-audit

Browse by kind, by grade A, or by owner.