Security audit of a codebase — web apps, APIs, services, CLI tools, libraries, daemons, and more. Use when asked to find security bugs, do a security review, audit for vulnerabilities, or pen-test the code. Focuses on exploitable issues with real impact, not theoretical concerns or industry-standard behavior.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Security Audit
You are a security auditor. Your job is to find **exploitable vulnerabilities with real impact**.
## Platform terminology
This skill is agent-neutral. In the methodology:
- **Task tool** means the coding agent's delegation or sub-agent mechanism.
- **`research` agent** means a delegated agent optimized for focused codebase exploration and factual verification.
- **`general` agent** means a delegated agent that can investigate broadly and spawn focused research agents.
- **`subagent_type`** means the equivalent delegated-agent role supported by the current platform.
Use the platform's equivalent capabilities while preserving the specified roles, parallelism, prompts, and independence boundaries.
## Setup
Before starting, establish two paths:
- **Target**: the codebase to audit (from the user's request or the current working directory)
- **Output directory**: where all audit artifacts go. Ask the user if not specified, or default to `~/security-audit-skill/<repo-name>/run-<N>` where `<N>` is the next unused integer (check what exists with `ls`). Create it if it doesn't exist. This ensures multiple runs against the same repo produce separate results.
…
The line at the top of this page pins the label git:20260630.01464ca, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
GET https://markdownregistry.com/api/v1/artifacts/art_hrhhlqoskjgczyap
GET https://markdownregistry.com/api/v1/resolve?ref=jim60105/copilot-prompt/security-audit
GET https://markdownregistry.com/api/v1/blob/831344bc4061ace06bdf494b61bd66bc4980e25c8145244db910c6bf7e873a56
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
jim60105/copilot-prompt · skills/add-artifact-attestations-to-workflow/SKILL.md · Add SLSA build-provenance attestations to existing GitHub Actions workflows. Use when the user wants to add artifact…
jim60105/copilot-prompt · skills/agent-browser/SKILL.md · Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages…
jim60105/copilot-prompt · skills/api-security/SKILL.md · Guideline for designing, implementing, and verifying secure APIs following OWASP API Security Top 10 (2023) best…
jim60105/copilot-prompt · skills/bash-script-writer/SKILL.md · Write, review, and optionally test Bash and Zsh shell scripts following project coding standards. Use for ANY shell…
jim60105/copilot-prompt · skills/brainstorming/SKILL.md · You MUST use this before any creative work - creating features, building components, adding functionality, or modifying…
jim60105/copilot-prompt · skills/bruno-api-testing/SKILL.md · Create, run, and maintain API test collections using Bruno (OpenCollection YAML format and legacy Bru format). Use when…
jim60105/copilot-prompt · skills/bump-version/SKILL.md · Automate version bumping following semantic versioning and changelog management. Use when the user wants to bump a…
jim60105/copilot-prompt · skills/chinese-content-writing-guideline/SKILL.md · Language-specific guidelines for producing high-quality Traditional Chinese (zh-TW) content: script, full-width…
jim60105/copilot-prompt · skills/chinese-traditional-conversion/SKILL.md · Convert simplified Chinese to Traditional Chinese (zh-TW), covering characters, Taiwan vocabulary, and phrasing. Use…
jim60105/copilot-prompt · skills/commit/SKILL.md · Create a git commit with clear, conventional commit messages. You MUST read this when the user wants to commit staged…
jim60105/copilot-prompt · skills/containerfile-creator/SKILL.md · Create high-quality, secure, and performance-optimized Containerfiles (Dockerfiles) following best practices for…
maxmiksa/auto-company · .claude/skills/security-audit/SKILL.md · Use when reviewing code security, auditing dependencies for CVEs, checking configuration or secret security, assessing…
cowork-os/cowork-os · resources/skills/security-audit/SKILL.md · Answer security questions about code, review a file or change for vulnerabilities, or run a full multi-agent audit of a…
josstei/maestro-orchestrate · plugins/maestro/skills/security-audit/SKILL.md · Run a Maestro-style security assessment for authentication, authorization, data exposure, secret handling, and…
