Results for “audit-trail”

Analyzes AWS CloudTrail events and trails, including trail health, API activity, security investigations, resource changes, and event selector audits, with parallel execution and anti-hallucination guardrails.

Add governance, safety, and trust controls to AI agent systems with policy enforcement, intent classification, and audit trails.

Assesses codebase maturity using Trail of Bits' 9-category framework, producing a professional scorecard with evidence-based ratings and actionable recommendations.

Guides maintenance of cross-border transfer registers, audit trails, and compliance documentation under GDPR Art. 30 and Art. 46, EDPB record-keeping guidance, and supervisory authority expectations. Keywords: transfer register, audit trail, Art. 30, Art. 46, documentation, compliance records.

Builds and queries multi-language source code graphs for security analysis, including blast radius, taint propagation, privilege boundaries, and entry point enumeration.

Audits project dependencies for supply chain risks including single maintainers, unmaintained packages, low popularity, high-risk features, past CVEs, and missing security contacts.

Prepares codebases for security review using Trail of Bits' checklist by setting review goals, running static analysis, increasing test coverage, removing dead code, and generating documentation.

Verifies that blockchain code implements exactly what documentation specifies, identifying gaps between specs and implementation for audit engagements.

Use to verify that the chain from conversation to evaluation to decision is complete and reconstructible, so a QA score or a customer outcome can be explained months later. Trigger for "can we prove why this decision was made", "is our audit trail complete", "reconstruct how this score was produced", evidencing an AI-assisted decision, or an auditor asking how a conclusion was reached.

Guides through a 5-step secure development workflow for smart contracts, including automated scanning with Slither, special feature validation, visual security diagrams, security property documentation, and manual review.

Audits Rust codebases for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS, FFI safety, and async runtime mistakes.

Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.

Safety guardrails for autonomous agents. Intercepts destructive actions and vets skills, requires structured approval before irreversible operations, with CLI-backed cryptographic audit trails and policy enforcement.

Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets.

Audit project structure for convention violations, missing files, template drift, and cross-platform sync gaps; optionally auto-fix

Find similar vulnerabilities and bugs across codebases using pattern-based analysis after identifying an initial issue.

Enumerate and audit Active Directory forest trust relationships using impacket for SID filtering analysis, trust key extraction, cross-forest SID history abuse detection, and inter-realm Kerberos ticket assessment.

Configure privileged session monitoring and recording using CyberArk PSM or open-source alternatives like Teleport, with keystroke logging, real-time alerts, and compliance audit trails.

System Audit — entry point

Deep audit of a skills directory against the Skill Creator standard. Produces a scored report and phased remediation plan.

Per-page UX audit using NN/g heuristics, Intuit microcopy, and Google HEART. Use when evaluating usability, auditing microcopy, checking UX heuristics, or assessing cognitive load. Cross-page flows/IA → audit-ux-journeys. Layout/breakpoints → audit-responsive. Empty/error states → audit-ui-states.

Perform a structured audit of a codebase covering security, code quality, performance, dependencies, architecture, and testing hygiene, then produce a prioritized findings report. Use this skill whenever the user asks for a code review, code audit, security review, codebase assessment, "look over this repo", "what's wrong with this codebase", legacy-code triage, pre-acquisition technical due diligence, or any request to systematically evaluate the health of a project. Trigger even when the user is casual ("can you eyeball my repo?") — this skill imposes the structure that ad-hoc review misses. This skill audits a whole repository at a point in time — for reviewing a diff or PR use the built-in code-review skill; for security checks on pending changes use security-review.

Read-only audit of app-layer auth — route×gate matrix, session lifecycle, OAuth, and provider traps (getSession vs getUser, middleware-as-only-gate, CVE-2025-29927). Use when "audit our auth", "check middleware protection". RLS → plan-rls-audit. OWASP checklist → audit-security.

Automated security auditing covering SAST, DAST, dependency scanning, secret detection, container hardening, and compliance checks before deployments or when integrating new dependencies.

Audit existing business processes to identify AI automation opportunities. TRIGGERS - Use when user wants to find AI opportunities, audit processes for automation, or assess AI readiness.

Read-only audit of unhappy-path UI states vibe-coding skips — empty, loading, error, offline, zero-results, permission, overflow — then plan fixes. Use when "check empty/error states", "audit loading states", or "what happens when this fails". Dead buttons → plan-stub-checker; backend timeouts → audit-resilience.

Audit existing business processes to identify AI automation opportunities. TRIGGERS - Use when user wants to find AI opportunities, audit processes for automation, or assess AI readiness.

Active Directory security audit using the MITRE ATT&CK framework. Full domain enumeration, trust mapping, GPO analysis, ACL abuse paths, ADCS attacks (ESC1-ESC8), delegation abuse (constrained/unconstrained/RBCD), fine-grained password policies, LAPS deployment, service account security, and Kerberos configuration. Uses enum4linux-ng, netexec, impacket, ldapsearch, certipy-ad, bloodhound-python, and rpcclient. Produces attack path diagrams, prioritized risk register, and PoCs. Chains into /gh-export for issue filing.

User-story-driven test coverage audit and plan — no test writing in this pass. Use when "test coverage plan", "coverage audit", "traceability matrix", "fake-green tests", "uncovered user stories", "plan tests for critical flows", or "whats not tested". Mutation score / assertion theater → test-mutation.

Audit service accounts across enterprise infrastructure to identify orphaned, over-privileged, and non-compliant accounts, covering Active Directory, cloud platforms, databases, and applications.