security-audit SKILL.md skillA
security-audit from huanmin123/ai-vibecode-superpower is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add huanmin123/ai-vibecode-superpower/security-audit@git:20261104.d6f23e3Pins git:20261104.d6f23e3 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- huanmin123/ai-vibecode-superpower
- Path
shared/skills/security-audit/SKILL.md- Versions recorded
- 2
- Latest version
- git:20261104.d6f23e3, committed Nov 4, 2026
- First version recorded
- Nov 4, 2026
- Size
- 16,907 bytes
- Repository stars
- 39
- License
- Apache-2.0
对目标项目及其运行环境做取证式安全审计：先测绘攻击面，再以攻击者视角建立攻击路径，按通用视角做多视角穷举排查，逐条用适用层的证据证实或证伪，并对外部漏洞事实做可追溯核实，输出含覆盖台账的审计报告。用于安全审计、漏洞排查、上线前体检、PR 安全审查、部署/主机/云配置审查；不用于依赖升级、普通功能开发、单点 bug 修复或未授权渗透测试。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# 安全审计 审计交付的是**可核对的结论**，不是漏洞清单。两条主线： 1. **攻击者视角**：从"谁、已经有什么、想得到什么、最便宜的路径是什么"组织排查，而不是从漏洞名出发。 2. **外部核实**：任何版本默认值、已知漏洞、修复版本、在野利用，都必须追溯到审计时打开过的来源。 > 本文所有入口类型、视角、层、画像、漏洞类、工具与来源列表都是**下界，不是全集**。看到任何清单，先问"这个目标还有哪些表外情况"，再按清单展开；不得因为"表里没有"而跳过。 ## 定位与边界 | 任务形态 | 走向 | | --- | --- | | 源码、配置、供应链、部署、主机、云、CI/CD 安全审查 | 本 skill | | 质量缺陷、隐藏 bug、回归风险 | `deep-dive-review` | | 跨文件实现、修复与独立验收 | `orchestrate-model-workflow` | | 依赖升级、普通功能开发、单点 bug 修复 | 不进本 skill | | 未授权渗透、主动打靶、红队 | 不在本 skill 范围 | 默认**只读**：不修改目标仓库的源码与配置，不对目标系统发起攻击性请求。报告写到用户指定路径；未指定时用项目外临时目录或聊天正文，不写入目标仓库源码/配置。需要修复时由用户另行发起；需要运行时/主机/云验证时，必须有明确授权并限定范围。 ## 不变量 违反任一条，该结论作废。 1. **攻击者目标优先**：每条 finding 要能回答"哪个画像、已有什么、想得到什么、还差哪一步"。只写"这里有个危险调用"不构成 finding。 2. **证据准入**：代码 finding 必须有 `source(file:line) → 传播路径 → sink(file:line)`，每一跳实际读取核对。非代码 finding 必须有适用层的可复核证据链：定位授权资源或只读命令、执行身份与时间、相关输出及控制和影响；区分已观察事实与未验证的部署或运行条件。只有模式匹配的，登记为线索。 3. **控制判定**：区分"控制缺失"与"控制存在但无效"，指出具体位置。框架/库默认行为必须按安装版本核实，不凭记忆。 4. **层与证据等级**：结论要标注属于哪一层（代码/配置/供应链/主机/网络/云/CI/数据）与证据等级（E1 仓库、E2 部署产物、E3 只读运行访问、E4 文档访谈）。不得把 E1/E2 推断写成 E3 事实。 5. **外部事实可追溯**：CVE/GHSA/公告/修复版本/默认行为必须给来源、版本、检索日期；没打开过的来源不引用，不编造编号或引文。 6. **时效性**：安全事实会过期。示例与历史结论只是起点，审计时重新核实；无法核实的写"未验证"。 …
Read the whole file at its exact version.
How to install
mdr add huanmin123/ai-vibecode-superpower/security-audit@sha256:171037f49e240eafThe line at the top of this page pins the label git:20261104.d6f23e3, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_zrukh6kcg4pf5hjp)
0 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 2 versions of this file, all committed on Nov 4, 2026.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261104.d6f23e3 latest | 2026-11-04 | d6f23e3 | 16,907 B | A | view · diff |
| git:20261104.2977611 | 2026-11-04 | 2977611 | 15,923 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (16907 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
huanmin123/ai-vibecode-superpower · 39 stars · license Apache-2.0 · pushed 2026-11-06 · branch master
API
GET https://markdownregistry.com/api/v1/artifacts/art_zrukh6kcg4pf5hjp GET https://markdownregistry.com/api/v1/resolve?ref=huanmin123/ai-vibecode-superpower/security-audit GET https://markdownregistry.com/api/v1/blob/171037f49e240eaffdd98b49a7c5e052337a02b6e0a68054f899c098d18c6d5d
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from huanmin123/ai-vibecode-superpower
Every file in huanmin123/ai-vibecode-superpower