Use when auditing security, checking for vulnerabilities, scanning for secrets, or reviewing dependencies. Dependency CVEs, git-history secret scanning, pre-commit hardening, and a full-repo OWASP audit.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
You are a security engineer auditing a repository's standing security posture.
Audit and report by default — read-only scans like `gitleaks git --redact` and `npm audit` are part of auditing. Wire up hooks or edit code only when the user asks you to fix, harden, or set something up; when the ask is unclear, report first and offer to apply the fixes.
## Scope
This skill audits the **repository**, not the change in front of you. Its centre of gravity is the four things a per-diff reviewer structurally cannot reach:
- vulnerable dependencies, which live in the lockfile rather than any diff
- secrets already committed to git history
- a missing pre-commit scanner, which is a gap in prevention rather than a finding in code
- vulnerabilities in code nobody has touched recently
Per-diff review is a different job with different tooling. In Claude Code, the `security-guidance` plugin already reviews each diff automatically on edit, commit, and push, in more depth than the rules below — so when the question is "is this change safe?", prefer that plugin and reach for this skill for the repo-wide sweep.
…
The line at the top of this page pins the label git:20261007.6a855c7, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
A 17 of 17 checks passed. Fixed automatic checks with no AI involved, so the same checks give the same answer every run.
pass: Frontmatter block present
pass: Frontmatter declares a name
pass: Frontmatter declares a description
pass: Size between 200 bytes and 200 KB (5171 bytes)
pass: No zero-width or bidi control characters
pass: No instruction hidden inside an HTML comment
pass: No link to an exfiltration or paste host
pass: No credential-shaped string
pass: No instruction to send local credentials anywhere
pass: No text hidden with inline styles
pass: No prompt-injection phrasing
pass: No curl or wget piped into a shell
pass: No recursive delete of root, home or parent
pass: No instruction to read or print local credentials
pass: No base64 blob over 200 characters
pass: No link to a raw IP address
pass: No script tag
Source
GitHub
tartinerlabs/skills · 8 stars · license MIT · pushed 2026-10-19 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_e2bbgxjklq4k6t27
GET https://markdownregistry.com/api/v1/resolve?ref=tartinerlabs/skills/security
GET https://markdownregistry.com/api/v1/blob/2752fdaf26c1e81aba95550b4899cebfe74d74a30e11343615c1bb4477169abd
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
tartinerlabs/skills · plugins/design/skills/accessibility/SKILL.md · Use when building or reviewing UI for accessibility — screen readers (VoiceOver, TalkBack), keyboard and focus, colour…
tartinerlabs/skills · plugins/design/skills/apple-featuring/SKILL.md · Use when preparing an Apple platform app for App Store featuring or the Apple Design Awards — readiness reviews before…
tartinerlabs/skills · plugins/design/skills/ux-psychology/SKILL.md · Use when designing, building, or reviewing a screen, flow, or page — landing and marketing pages, onboarding, sign-up…
tartinerlabs/skills · plugins/quality/skills/i18n/SKILL.md · Use when internationalising or localising an app, preparing it for translation, extracting hardcoded strings, adding…
tartinerlabs/skills · plugins/quality/skills/project-structure/SKILL.md · Use when deciding where code should live, organising files, or auditing project structure. Checks colocation, grouping…
tartinerlabs/skills · plugins/security/skills/deps/SKILL.md · Use when hardening a dependency supply chain, pinning versions, adding registry/security flags, or setting up Renovate…
tartinerlabs/skills · plugins/tooling/skills/setup/SKILL.md · Use when setting up a project, adding linting, formatting, git hooks, or type checking. Detects the language and…
tartinerlabs/skills · plugins/tooling/skills/testing/SKILL.md · Use when writing tests, running tests, adding test coverage, or debugging test failures. Detects the language and its…
tartinerlabs/skills · plugins/tooling/skills/update-project/SKILL.md · Use when updating docs, syncing CLAUDE.md, AGENTS.md, or README.md, fixing stale documentation, or refreshing project…
boshu2/agentops · skills/security/SKILL.md · Review code for security problems; scan for vulnerabilities, secrets, dependency and prompt risks. Use when: asked…
boshu2/agentops · plugin/skills/security/SKILL.md · Review code for security problems; scan for vulnerabilities, secrets, dependency and prompt risks. Use when: asked…
openhands/extensions · skills/security/SKILL.md · Security best practices for secure coding, authentication, authorization, and data protection. Use when developing…
