Results for “audit”

Scans source code repositories across C++, Android, iOS, and Web to classify files, detect embedded third-party libraries, and produce actionable four-level verdicts per module with interactive HTML reports.

Audits trending open-source repos for exploitable vulnerabilities using Semgrep, TruffleHog, osv-scanner, and Slither, then routes findings to responsible disclosure channels (PVR for code flaws, public PRs for dependency CVEs).

Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure.

12 regulatory & QM agent skills and plugins for Claude Code, Codex, Gemini CLI, Cursor, OpenClaw. ISO 13485 QMS, MDR 2017/745, FDA 510(k)/PMA, ISO 27001 ISMS, GDPR/DSGVO, risk management (ISO 14971), CAPA, document control, auditing. Python tools (stdlib-only).

Dependency auditing for Nick's projects with focus on Node and Python. Use before deploys, during maintenance, or when checking packages for vulnerabilities, outdated versions, license issues, and upgrade risk. Flags critical CVEs as deploy blockers and produces a prioritized upgrade plan.

Critically audit agent skills and remove content that is outdated, disproven, model-specific, or based on poorly cited sources. Load when improve-skills runs its per-skill cycle, when the user asks to prune skills, remove outdated techniques, check if skills are still valid, verify citations in skills, audit skill sources, or update skills for a new model release. Also triggers on "are these skills still valid", "check for obsolete techniques", "verify skill citations", or "update skills for GPT-5/Claude 4/Gemini 2". Runs before split-skill and compress-skill — removing bad content first means the remaining content is worth preserving.

Parse RFP/RFI/RFQ documents, score fit per requirement with verifiable proof points, generate win-themes, estimate winrate, and produce a bid/no-bid recommendation using the Shipley method.

Audit Google Business Profiles, generate neighborhood service area pages, check NAP consistency across directories, create LocalBusiness schema, and write review responses for service-area businesses.

Performs a systematic diagnostic scan of an AI workflow across 5 quality dimensions — prompt quality, context efficiency, tool health, architecture fitness, and safety — producing a scored report with prioritized remediation actions.

Assess platform firmware security using Intel CHIPSEC: verify SPI flash write protection, BIOS lock, SMM/SMRR, Secure Boot variables, dump SPI flash, and triage UEFI variables for firmware-level threats.

Audit Google Cloud Platform environments for security misconfigurations using Forseti, Security Command Center, and gcloud CLI to evaluate IAM policies, firewall rules, storage permissions, and CIS compliance.

Audits and fixes responsive design issues across breakpoints, including fixed widths, missing media queries, non-responsive images, undersized touch targets, and horizontal scroll, with framework detection and verification at mobile, tablet, desktop, and wide viewports.

Audits technical SEO across nine categories including crawlability, indexability, security, URL structure, mobile, Core Web Vitals, structured data, JavaScript rendering, and IndexNow, producing a scored report with prioritized fixes.

Host security hardening and risk-tolerance configuration for SolanaOS deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure review, SolanaOS cron scheduling for periodic checks, or version status checks on a machine running SolanaOS (laptop, workstation, Pi, VPS).

Local-first secret scanning for repos and git history. Use before every push, when scanning for exposed keys, checking for committed credentials, or auditing a repo for accidental secret leaks. Designed for Nick's workflow and safer than forcing suspicious marketplace secret scanners.

NN/g-grounded page enhancement for flows and semantic data wiring — not visual polish. Use when "this page feels AI-generated", "fix UX of /xxx", "improve information density", or "icons all look the same". Composition/type → enhance-web-ui. Heuristics-only → audit-ux.

Design-token systems — semantic CSS custom properties for colours, spacing, typography, and shadows, with light/dark theme switching via `[data-theme]` overrides. Use when setting up a token catalogue, auditing components for hardcoded colours/magic numbers, or adding dark-mode support via token swaps.

Review a built frontend against its chosen direction, catch drift back to generic AI defaults, enforce state coverage, ethical patterns, UX heuristics, and polish, and check contrast with APCA (not the legacy WCAG ratio). Produces specific, prioritized fixes — never vibes-based feedback. Works with pasted screenshots or Playwright MCP automated capture. Load when the user asks to review a UI, audit a design, check if a frontend looks generic or vibecoded, evaluate visual quality or polish, says "review this UI", "is this design good", "audit my frontend", "does this feel like [product]", "design QA", or when frontend-design routes here. Sub-skill of frontend-design.

Deploy privileged access management for database systems including Oracle, SQL Server, PostgreSQL, and MySQL, covering session proxy configuration, credential vaulting, query auditing, dynamic credential generation, and least-privilege database roles.

Builds detailed voice profiles for characters, narrators, brands, or AI agents, covering diction, syntax, rhythm, worldview, signature patterns, and failure modes, and can reverse-engineer profiles from writing samples or audit existing ones.

Use when auditing an ACL submission before an ACL Rolling Review cycle deadline, covering long/short paper page budgets, the mandatory Limitations section, Responsible NLP checklist, anonymized PDFs and supplements, preprint declarations, dual-submission rules, resubmission linking, and ARR desk-reject triggers on OpenReview.

Technical architecture guide for building a multi-purpose consent preference center. Covers per-purpose granularity, easy withdrawal under Article 7(3), version history, audit trails, and IAB Transparency and Consent Framework v2.2 integration. Includes database schema, API design, and UI component specifications.

Search past WhatsApp/chat conversations stored in the audit log PostgreSQL database. Use when the user asks about past conversations, what was discussed, what someone said, finding a specific message, or referencing previous discussions. Also use to reply to or quote specific past messages.

Equipment manager for Claude Code projects — inventory local skills/agents/scripts, audit external upstream repos (red-flag + prompt-injection screening), and sync selectively after user approval. Absorbs container-layout skill repos AND single-skill-at-root repos (e.g. a company design-system repo). Project-agnostic.

Audit a site for answer-engine / GEO citation readiness (ChatGPT, Perplexity, AI Overviews), then a phased plan. Use when "AEO", "GEO", "show up in ChatGPT/Perplexity", "AI search visibility", "llms.txt", or "am I blocking AI crawlers". Classic SEO meta/sitemap → enhance-web-seo.

Host security hardening and risk-tolerance configuration for OpenClaw deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure review, OpenClaw cron scheduling for periodic checks, or version status checks on a machine running OpenClaw (laptop, workstation, Pi, VPS).

When the user wants to optimize content for AI search engines, get cited by LLMs, or appear in AI-generated answers. Also use when the user mentions 'AI SEO,' 'AEO,' 'GEO,' 'LLMO,' 'answer engine optimization,' 'generative engine optimization,' 'LLM optimization,' 'AI Overviews,' 'optimize for ChatGPT,' 'optimize for Perplexity,' 'AI citations,' 'AI visibility,' 'zero-click search,' 'how do I show up in AI answers,' 'LLM mentions,' or 'optimize for Claude/Gemini.' Use this whenever someone wants their content to be cited or surfaced by AI assistants and AI search engines. For traditional technical and on-page SEO audits, see seo-audit. For structured data implementation, see schema-markup.

Audits codebases for common security vulnerabilities that AI coding assistants introduce in "vibe-coded" applications. Checks for exposed API keys, broken access control (Supabase RLS, Firebase rules), missing auth validation, client-side trust issues, insecure payment flows, and more. Use this skill whenever the user asks about security, wants a code review, mentions "vibe coding", or when you're writing or reviewing code that handles authentication, payments, database access, API keys, secrets, or user data — even if they don't explicitly mention security. Also trigger when the user says things like "is this safe?", "check my code", "audit this", "review for vulnerabilities", or "can someone hack this?".

Launches four parallel read-only sub-agents to review a git diff or file scope for regressions, security risks, performance issues, and contract gaps, then aggregates findings into a prioritized fix path.

Hunt for DNS-based persistence mechanisms including DNS hijacking, dangling CNAME records, wildcard DNS abuse, and unauthorized zone modifications using passive DNS databases, SecurityTrails API, and DNS audit log analysis.

Find over-permissive RBAC roles and service-account token abuse paths in Kubernetes using kubectl auth can-i, rbac-police, kubectl-who-can, and rakkess during authorized cluster security reviews.

Audits a project's agent configuration files, establishes a source-of-truth skills directory, normalizes naming, and generates bridge files to make the workspace consistent across Claude Code, Codex, Grok, and generic Agents.

Use when auditing an ESEC/FSE research-track submission for HotCRP readiness, covering the mandatory paper-registration step, the ACM Primary Article Template page budget, double-anonymous "heavy" anonymity, the open-science Data Availability statement, PACMSE publication, and desk-reject triage before the AoE cutoff.

Detect and exploit DOM-based XSS vulnerabilities by auditing JavaScript for tainted data flow from controllable sources to dangerous sinks, with payloads and bypass techniques for client-side testing.

Use for designing, auditing, or refactoring a GitHub Copilot customization system in Visual Studio Code across instructions, prompt files, Agent Skills, custom agents, hooks, MCP servers, and plugins. Do not use merely to author one already-selected artifact or configure unrelated VS Code settings.

LinkedIn Ads platform expertise. Audit campaigns, optimize targeting (job title, company, seniority, industry), creative strategy, Lead Gen Forms, conversion tracking, and ABM campaigns. Use when the user asks about LinkedIn advertising, B2B paid social, LinkedIn campaign optimization, Lead Gen Forms, Matched Audiences, or professional audience targeting.