Review code, configuration, permissions, authentication, data handling, and dependencies for exploitable security weaknesses. Use for security reviews, threat analysis, trust boundaries, secrets, authorization, sandboxing, and dangerous command handling.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Security Audit
Report concrete attack paths and evidence, not generic checklists.
## Procedure
1. Establish assets, actors, entry points, trust boundaries, and deployment assumptions.
2. Trace untrusted input from ingress to sensitive sinks.
3. Review authentication, authorization, tenancy, and ownership separately.
4. Inspect secret storage, logging, serialization, file paths, commands, and network destinations.
5. Check fail-open behavior, race conditions, replay, confused-deputy paths, and privilege escalation.
6. Validate dependency findings against the versions actually resolved by the project.
7. Rank findings by exploitability and impact.
8. For each finding, provide evidence, an attack scenario, and a specific remediation.
9. Distinguish confirmed vulnerabilities from defense-in-depth recommendations.
## Safety
- Do not run destructive exploitation against real data or external systems.
- Use local fixtures or isolated environments for proof of concept.
- Never expose secrets in logs or reports.
- Do not claim a vulnerability from a pattern match without tracing reachability.
## Report
Order findings by severity.
…
The line at the top of this page pins the label git:20260816.716d56b, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
GET https://markdownregistry.com/api/v1/artifacts/art_wo2tct4bjkrktkql
GET https://markdownregistry.com/api/v1/resolve?ref=miosa-osa/osa/security-audit
GET https://markdownregistry.com/api/v1/blob/637fb29c2a30e80c2b06bbfd239ec9e21bf627066501546cd10996ff2c1da72b
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
miosa-osa/osa · examples/skills/meeting-prep/SKILL.md · Research attendees, prepare talking points, and summarize previous interactions before meetings
maxmiksa/auto-company · .claude/skills/security-audit/SKILL.md · Use when reviewing code security, auditing dependencies for CVEs, checking configuration or secret security, assessing…
cowork-os/cowork-os · resources/skills/security-audit/SKILL.md · Answer security questions about code, review a file or change for vulnerabilities, or run a full multi-agent audit of a…
josstei/maestro-orchestrate · plugins/maestro/skills/security-audit/SKILL.md · Run a Maestro-style security assessment for authentication, authorization, data exposure, secret handling, and…
