audit-security SKILL.md skillA
audit-security from jasonxudeveloper/nino is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add jasonxudeveloper/nino/audit-security@git:20261031.3e555fcPins git:20261031.3e555fc in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- jasonxudeveloper/nino
- Path
.claude/skills/audit-security/SKILL.md- Versions recorded
- 5
- Latest version
- git:20261031.3e555fc, committed Oct 31, 2026
- First version recorded
- Oct 30, 2026
- Size
- 7,035 bytes
- Repository stars
- 652
- License
- MIT
Audit and extend Nino's defenses against hostile input in every runtime (.NET, Go, Rust, TypeScript and the code nino-gen writes) - NinoDataException through NinoThrow, lengths checked before allocating, depth limits, canonical bytes only, hash-flooding limits, the Untrusted settings - and run the fuzzers, hostile-input tests and the malicious corpus. Use for any change to a read path, a new type or collection, a new setting, or a security review. Triggers: NinoDataException, NinoThrow…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Security (hostile input) Nino reads untrusted data (network messages, files, request bodies): crafted bytes must never crash the process, read outside the input, allocate out of proportion to it, recurse without a bound or take time out of proportion to it. These rules hold in .NET; each runtime's own form of them is in `runtimes/*/AGENTS.md`, and generated code follows the runtime it targets. ## Rules - Every check of the data throws `NinoDataException`, through a `NinoThrow` helper (out of line). The caller's mistakes and the write side (a graph nested too deep or holding itself, a collection changed while written) keep `InvalidOperationException`. Tests assert the exact type (`Assert.ThrowsExactly`). - Check a length against the bytes left (`TryReadLength`, `NinoLimits.TooLong`) before allocating; grow, never presize, what an element larger in memory than on the wire claims. Every recursive path counts depth: class bodies through `Depth`, structs and collections that can hold themselves through `EnterStruct`/`ExitStruct` on both the reader and the writer, against `NinoSettings.MaxDepth`. …
Read the whole file at its exact version.
How to install
mdr add jasonxudeveloper/nino/audit-security@sha256:2818baf5c4aa639bThe line at the top of this page pins the label git:20261031.3e555fc, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_h32fk6gukfsm5uko)
3 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 5 versions of this file, between Oct 30, 2026 and Oct 31, 2026, more than one a day.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261031.3e555fc latest | 2026-10-31 | 3e555fc | 7,035 B | A | view · diff |
| git:20261030.313f1eb | 2026-10-30 | 313f1eb | 6,020 B | A | view · diff |
| git:20261030.c11411e | 2026-10-30 | c11411e | 6,000 B | A | view · diff |
| git:20261030.370d4be | 2026-10-30 | 370d4be | 5,865 B | A | view · diff |
| git:20261030.e2e28fe | 2026-10-30 | e2e28fe | 5,262 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (7035 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
jasonxudeveloper/nino · 652 stars · license MIT · pushed 2026-11-03 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_h32fk6gukfsm5uko GET https://markdownregistry.com/api/v1/resolve?ref=jasonxudeveloper/nino/audit-security GET https://markdownregistry.com/api/v1/blob/2818baf5c4aa639be621d5be80cf17e1b132fdec205c95c6363451d8408797c2
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from jasonxudeveloper/nino
Every file in jasonxudeveloper/nino