security-audit SKILL.md skillB
security-audit from karsten-s-nielsen/mad-scientist-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add karsten-s-nielsen/mad-scientist-skills/security-audit@git:20260724.35d8a81Pins git:20260724.35d8a81 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- B, 16 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- karsten-s-nielsen/mad-scientist-skills
- Path
plugins/mad-scientist-skills/skills/security-audit/SKILL.md- Versions recorded
- 5
- Latest version
- git:20260724.35d8a81, committed Jul 24, 2026
- First version recorded
- Mar 2, 2026
- Size
- 59,378 bytes
- Repository stars
- 3
- License
- MIT
Comprehensive security audit with two modes and two tiers. Planning mode reviews architecture for security gaps (STRIDE threat modeling, auth design, data classification, AI regulatory compliance). Audit mode scans code, infrastructure, dependencies, and secrets for vulnerabilities. Covers OWASP Top 10, ML/AI model security (serialization safety, provenance, poisoning), AI regulatory compliance (EU AI Act, biometric privacy, EU Data Act), web security headers, API boundary security…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Security Audit A comprehensive security skill with two modes and two tiers: **Modes:** - **Planning** (before code exists) — threat modeling, auth design, data classification - **Audit** (on existing code) — vulnerability scanning, infrastructure review, dependency audit **Tiers** (applied within each phase): - **Standard** — free tools, code-level patterns, open-source scanners. Always actionable for any developer. - **Enterprise** — paid services (WAF, SIEM, DAST/SAST), compliance tooling. Serves as a professional checklist documenting what enterprise teams should implement. **Core question:** "Is this system defensible?" ## When to use this skill - When the user says "security audit", "threat model", "check for vulnerabilities", "review security", or "harden this" - Before designing a new system (planning mode) — to identify threats early - On an existing codebase (audit mode) — to find and fix vulnerabilities - Before a production deployment — to validate security posture - After adding authentication, authorization, or data handling features ## Mode detection Determine which mode to operate in based on the project state: | Signal | Mode | Rationale | …
Read the whole file at its exact version.
How to install
mdr add karsten-s-nielsen/mad-scientist-skills/security-audit@sha256:ff87316d9d2e5341The line at the top of this page pins the label git:20260724.35d8a81, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_itqidio2ly7efxwe)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 5 versions of this file, between Mar 2, 2026 and Jul 24, 2026, about one every 36 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260724.35d8a81 latest | 2026-07-24 | 35d8a81 | 59,378 B | B | view · diff |
| git:20260331.dc11d83 | 2026-03-31 | dc11d83 | 52,865 B | B | view · diff |
| git:20260329.f91268f | 2026-03-29 | f91268f | 49,502 B | B | view · diff |
| git:20260328.59409ec | 2026-03-28 | 59409ec | 49,349 B | B | view · diff |
| git:20260302.6c7fd28 | 2026-03-02 | 6c7fd28 | 40,248 B | B | view |
Audit of the latest version
- fail: No script tag (matched: <script)
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (59378 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
Starting a new one? Use a template for SKILL.md on mdpantry, which passes every one of these checks and says what to change in it.
Source
karsten-s-nielsen/mad-scientist-skills · 3 stars · license MIT · pushed 2026-10-01 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_itqidio2ly7efxwe GET https://markdownregistry.com/api/v1/resolve?ref=karsten-s-nielsen/mad-scientist-skills/security-audit GET https://markdownregistry.com/api/v1/blob/ff87316d9d2e53413a4a3f389517264f3df46cab50b79a88a4277664cc1521f5
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from karsten-s-nielsen/mad-scientist-skills
Every file in karsten-s-nielsen/mad-scientist-skills