Focused security review of a change. Finds HIGH-CONFIDENCE, concretely exploitable vulnerabilities in the staged diff (injection, broken authn/authz, secrets and data exposure, unsafe deserialization, crypto misuse, SSRF) and audits dependencies when a lockfile moved, using the repo's own package manager. Runs as Check 7 of /flagrare:implementation-review, and standalone when the user says 'security review', 'security audit', 'check this for vulnerabilities', 'is this safe', 'any security…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Security Audit
> **No em-dashes.** Nothing this skill writes may contain an em-dash; use a comma, colon, or parentheses instead. Enforced by a repo hook that flags em-dashes in generated `.md`. See `/flagrare:write-docs`.
A focused security pass over a change. The job is narrow on purpose: find the vulnerabilities that a senior security engineer would confidently raise in review, and stay silent about everything else. A security review that flags twenty theoretical issues gets ignored; one that flags the two real ones gets acted on. Noise is the enemy, not thoroughness.
This skill is the single source of security truth for the collection. It runs two ways:
- **As Check 7 of `/flagrare:implementation-review`**, a parallel subagent whose brief pulls in this skill's content, the same way Checks 2 to 4 pull in `/flagrare:testing-philosophy`. Diff-scoped, fast.
- **Standalone** (`/flagrare:security-audit`), when you want a deliberate pass on demand.
---
## The one rule that matters
**Only report a finding you can attach a concrete exploit path to, and only when you are over 80% confident it is actually exploitable.** Everything else in this skill serves that rule.
…
The line at the top of this page pins the label git:20260716.591a312, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
GET https://markdownregistry.com/api/v1/artifacts/art_skfuhqmccehsamcu
GET https://markdownregistry.com/api/v1/resolve?ref=flagrare/agent-skills/security-audit
GET https://markdownregistry.com/api/v1/blob/9def26a2ce51409e0ab2a3028a99e2a0c5826ea7ad7dec6318a0aa51b7126a9b
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
flagrare/agent-skills · plugins/flagrare/skills/atdd-plan/SKILL.md · Produce an ATDD-first implementation plan in Claude Code's native plan mode, with named design patterns called out…
flagrare/agent-skills · plugins/flagrare/skills/brag-doc/SKILL.md · Generate a comprehensive, impact-framed brag-doc entry for a chosen time window (day, week, biweek, month, or custom)…
flagrare/agent-skills · plugins/flagrare/skills/bug-bash/SKILL.md · Programmatic bug bashing, ingest a prescribed test plan (Notion, markdown, pasted spec), drive a real running system…
flagrare/agent-skills · plugins/flagrare/skills/career/SKILL.md · Run the career skills that are due, in one pass, and return one short combined digest plus an updated board. It reads…
flagrare/agent-skills · plugins/flagrare/skills/codebase-explore/SKILL.md · Explore the codebase to map conventions, reusable utilities, analogous features, and data flows relevant to a planned…
flagrare/agent-skills · plugins/flagrare/skills/communication-setup/SKILL.md · Set up, change or remove how Claude talks to you: a custom output style with your reply rules, a reminder of those…
flagrare/agent-skills · plugins/flagrare/skills/daily-code-review/SKILL.md · Generate a daily code review report showing stale PRs, items needing your attention, and active work for your team. Use…
flagrare/agent-skills · plugins/flagrare/skills/debug-hunt/SKILL.md · Evidence-first debugging for bugs that are hard to reproduce, intermittent, performance-related, or where previous…
flagrare/agent-skills · plugins/flagrare/skills/design-review/SKILL.md · Evaluate and refine UI the way a senior product designer would, visual hierarchy, spacing and rhythm, typographic…
flagrare/agent-skills · plugins/flagrare/skills/editorial-pass/SKILL.md · Review a finished or near-finished document the way a human editor reads it, start to finish, building a model of what…
flagrare/agent-skills · plugins/flagrare/skills/figma-matcher/SKILL.md · Enforces pixel-perfect implementation of Figma designs by exhaustively extracting every visual property from Figma…
maxmiksa/auto-company · .claude/skills/security-audit/SKILL.md · Use when reviewing code security, auditing dependencies for CVEs, checking configuration or secret security, assessing…
cowork-os/cowork-os · resources/skills/security-audit/SKILL.md · Answer security questions about code, review a file or change for vulnerabilities, or run a full multi-agent audit of a…
josstei/maestro-orchestrate · plugins/maestro/skills/security-audit/SKILL.md · Run a Maestro-style security assessment for authentication, authorization, data exposure, secret handling, and…
