How do I install the Security Audit skill?

Run npx skillmds@latest add ariffazil/security-audit in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Security Audit safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Security Audit?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Security Audit free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Security Audit?

ariffazil (@ariffazil) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Security Audit by ariffazil — Agent Skill

Name: Security Audit
Rating: 4.666666666666667 (3 reviews)
Author: ariffazil

Security Audit

Static analysis + README truth checking. Multi-stage automated code health, type-checking, linting, unit test coverage, and AST security vulnerability auditor. Verify that repo READMEs accurately describe current structure, ports, dependencies, and authority boundaries.

ariffazil Updated Sep 10, 2026

File contents

Security Audit — Static Analysis & README Truth Check

DITEMPA BUKAN DIBERI — Code quality and documentation truth are verified, not assumed.

What This Skill Is

A unified security and documentation audit skill covering:

Static Analysis — multi-stage automated code health, type-checking, linting, unit test coverage, and AST security vulnerability auditing
README Truth Check — verify that repo READMEs accurately describe current structure, ports, dependencies, and authority boundaries

When to Use

Before submitting PRs or requesting 888 JUDGE seal
After any reorganization
Before releasing a new version
When onboarding a new developer
Quarterly doc audit
"Security audit", "code quality", "static analysis", "README check", "doc drift"

When NOT to Use

Runtime health checks (use verify-work)
Incident response (use incident-response)

§1. STATIC ANALYSIS — Unified Diagnostic Pipeline

Pass 1: Syntax & Style Linting (Ruff)

uv run ruff check . --fix

Pass 2: Strict Type Verification (Pyright)

uv run pyright

Pass 3: Test Execution & Coverage (Pytest)

uv run pytest -v --cov=. --cov-report=term-missing

Pass 4: Security Vulnerability & AST Audit (Semgrep / Bandit)

uv run semgrep --config=p/security-audit .

Best Practices

Zero Untested PRs: Guarantee minimum 80% test coverage before submitting PRs or requesting 888 JUDGE seal.
Deterministic Fixes: Use ruff check --fix and pyright to resolve type errors before running tests.

§2. README TRUTH CHECK

READMEs become stale quickly. This skill compares the README's claims against the actual repo state and flags discrepancies.

Step 1: Directory Structure Check

Compare README's directory tree against ls -la. Flag:

Phantom directories (in README, not on disk)
Missing directories (on disk, not in README)
Renamed directories

Step 2: Port/URL Check

Compare README's claimed ports/URLs against reality:

ss -tlnp for listening ports
curl for HTTP endpoints
systemctl status for services

Step 3: Dependency Check

Compare README's claimed dependencies against package.json, pyproject.toml, etc.

Step 4: Authority Check

Verify README does not claim constitutional authority incorrectly.

Output

## README Truth Check: <repo>

### Structure Drift
- [ ] Phantom: `agent/` (README) vs `agents/` (disk)

### Port Drift
- [ ] Claimed: GEOX 18081 — Actual: 8081

### Dependency Drift
- [ ] None / [list]

### Recommendations
1. Update README directory structure — P1

---name: security-auditdescription: Static analysis + README truth checking. Multi-stage automated code health, type-checking, linting, unit test coverage, and AST security vulnerability auditor. Verify that repo READMEs accurately describe current structure, ports, dependencies, and authority boundaries.---# Security Audit — Static Analysis & README Truth Check> **DITEMPA BUKAN DIBERI** — Code quality and documentation truth are verified, not assumed.## What This Skill IsA unified security and documentation audit skill covering:1. **Static Analysis** — multi-stage automated code health, type-checking, linting, unit test coverage, and AST security vulnerability auditing2. **README Truth Check** — verify that repo READMEs accurately describe current structure, ports, dependencies, and authority boundaries## When to Use- Before submitting PRs or requesting 888 JUDGE seal- After any reorganization- Before releasing a new version- When onboarding a new developer- Quarterly doc audit- "Security audit", "code quality", "static analysis", "README check", "doc drift"## When NOT to Use- Runtime health checks (use `verify-work`)- Incident response (use `incident-response`)## §1. STATIC ANALYSIS — Unified Diagnostic Pipeline### Pass 1: Syntax & Style Linting (Ruff)```bashuv run ruff check . --fix```### Pass 2: Strict Type Verification (Pyright)```bashuv run pyright```### Pass 3: Test Execution & Coverage (Pytest)```bashuv run pytest -v --cov=. --cov-report=term-missing```### Pass 4: Security Vulnerability & AST Audit (Semgrep / Bandit)```bashuv run semgrep --config=p/security-audit .```### Best Practices1. **Zero Untested PRs**: Guarantee minimum 80% test coverage before submitting PRs or requesting 888 JUDGE seal.2. **Deterministic Fixes**: Use `ruff check --fix` and `pyright` to resolve type errors before running tests.## §2. README TRUTH CHECKREADMEs become stale quickly. This skill compares the README's claims against the actual repo state and flags discrepancies.### Step 1: Directory Structure CheckCompare README's directory tree against `ls -la`. Flag:- Phantom directories (in README, not on disk)- Missing directories (on disk, not in README)- Renamed directories### Step 2: Port/URL CheckCompare README's claimed ports/URLs against reality:- `ss -tlnp` for listening ports- `curl` for HTTP endpoints- `systemctl status` for services### Step 3: Dependency CheckCompare README's claimed dependencies against `package.json`, `pyproject.toml`, etc.### Step 4: Authority CheckVerify README does not claim constitutional authority incorrectly.### Output```markdown## README Truth Check: <repo>### Structure Drift- [ ] Phantom: `agent/` (README) vs `agents/` (disk)### Port Drift- [ ] Claimed: GEOX 18081 — Actual: 8081### Dependency Drift- [ ] None / [list]### Recommendations1. Update README directory structure — P1```

Frequently asked questions