Run a Maestro-style security assessment for authentication, authorization, data exposure, secret handling, and exploitability risks.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Maestro Security Audit
Call `get_skill_content` with resources: ["architecture"].
## Protocol
Before delegating, call `get_skill_content` with resources: ["delegation"] and follow the returned methodology.
## Workflow
1. Define the audit scope from the user request and relevant code paths
2. Trace trust boundaries, auth flows, secret handling, and data exposure paths
3. Review for exploitable flaws, unsafe defaults, OWASP Top 10 vulnerabilities, and high-risk dependencies
4. Classify findings by severity (CVSS-aligned) with file references and exploitability assessment
5. Provide remediation guidance with the highest-risk issues first
## Constraints
- Prefer actionable findings over generic security advice
- Present findings before proposing remediation
- State clearly when the review is limited by unavailable runtime context
- Do not modify code without explicit user approval
The line at the top of this page pins the label git:20260410.f5a5165, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
GET https://markdownregistry.com/api/v1/artifacts/art_ooddh4jx2yiylooc
GET https://markdownregistry.com/api/v1/resolve?ref=josstei/maestro-orchestrate/security-audit
GET https://markdownregistry.com/api/v1/blob/70f740293b5a3f337b895cfcb04d28fc3961470b82d493037dac9c4aa4aef7f5
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
josstei/maestro-orchestrate · claude/skills/a11y-audit/SKILL.md · Run a Maestro-style accessibility audit for WCAG compliance, ARIA usage, keyboard navigation, and screen reader…
josstei/maestro-orchestrate · claude/skills/compliance-check/SKILL.md · Run a Maestro-style regulatory compliance review for GDPR/CCPA, cookie consent, data handling, and licensing
josstei/maestro-orchestrate · claude/skills/orchestrate/SKILL.md · Run the full Maestro workflow for complex engineering tasks that need a mandatory design dialogue, approved…
josstei/maestro-orchestrate · claude/skills/perf-check/SKILL.md · Run a Maestro-style performance assessment for hotspots, regressions, and optimization planning
maxmiksa/auto-company · .claude/skills/security-audit/SKILL.md · Use when reviewing code security, auditing dependencies for CVEs, checking configuration or secret security, assessing…
cowork-os/cowork-os · resources/skills/security-audit/SKILL.md · Answer security questions about code, review a file or change for vulnerabilities, or run a full multi-agent audit of a…
