Results for “audit”

Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations, detecting attack vectors where attacker-controlled input reaches AI agents in CI/CD pipelines.

Audits codebases for leaked secrets and hardcoded credentials, generates .env templates, configures secrets management with AWS Secrets Manager, Vault, Doppler, or GCP Secret Manager, sets up credential rotation, and integrates secrets into CI/CD pipelines via OIDC federation.

Scaffolds fullstack projects (Next.js, FastAPI, MERN, Django) and analyzes code quality with security and complexity scoring.

Audit GitHub Actions workflow efficiency and recommend fixes to reduce CI minutes and costs.

Fork, sanitize, and package private projects for safe public release through a three-stage pipeline.

Generate consistent, auditable release notes from Conventional Commits, compute semantic version bumps, and enforce commit format linting.

Runs a fast quality gate that detects the project stack, performs static analysis, checks cross-layer consistency, and fixes issues between pipeline phases.

Provides expert guidance for using n8n-mcp MCP server tools to build, validate, and manage n8n workflows efficiently.

Validates CircleCI configuration files and custom Orbs using the CircleCI CLI and Orb Development Kit, checking for deprecated images, inefficient caching, and security anti-patterns.

Assess software supply chain security by generating SBOMs, scanning dependencies, auditing CI/CD pipelines, analyzing container images, and verifying vulnerability reachability.

Gates a git branch before merge by running code review, security, test, and accessibility passes on the diff, then emits a single verdict.

Audits deployment readiness across CI/CD, containers, monitoring, IaC, secrets, CDN, and DNS, scoring each area and identifying critical gaps, with optional auto-fix via chained sub-skills.

Defines, validates, runs, resumes, and audits repo-local multi-step automations using the `asc workflow` CLI and `.asc/workflow.json`, including step outputs and safe release/TestFlight workflows.

Run Semgrep static analysis scans with automatic language detection, parallel subagent execution, and merged SARIF output. Supports full ruleset coverage or high-confidence security vulnerability filtering.

Audit environment-variable hygiene and secrets safety across local development and production with practical scanning, drift awareness, and rotation readiness.

Prepares codebases for security review using Trail of Bits' checklist by setting review goals, running static analysis, increasing test coverage, removing dead code, and generating documentation.

Scans a codebase for security, database, deployment, code quality, AI/LLM, dependency, frontend, and observability issues before deployment. Intercepts deploy commands and blocks until critical items pass.

Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure.

Audits a project's agent configuration files, establishes a source-of-truth skills directory, normalizes naming, and generates bridge files to make the workspace consistent across Claude Code, Codex, Grok, and generic Agents.

Provides a repeatable, auditable workflow for large coding tasks by initializing repo-local task artifacts, installing subagent templates, and running a spec-freeze → build → evidence → verify → fix loop with fresh-session verification.