security-audit-r-package
Perform comprehensive security audits of R/Bioconductor packages, identifying vulnerabilities, native code security issues, code quality problems, and dependency risks.
Usage
Invoke this skill to audit an R package:
- "Run security audit on this R package"
- "Check this package for security vulnerabilities"
- "Security audit only the R/ directory"
Prerequisites
- Working directory is an R package.
- Internet access to fetch audit instructions from the reference gist.
Process
- Determine Audit Scope: Default is the entire package (
DESCRIPTION, NAMESPACE, R/, src/). The user may specify a subset.
- Fetch Audit Instructions: Read the standardized security audit instructions from:
https://gist.github.com/lwaldron/0606c678e7d81b012a1b05901cf4b732
These instructions define the categories to check, standardized issue type labels, and required fields.
- Read Files: Read all files within the defined scope.
- Analyze for Issues: Review the code against the checklist defined in the gist. Address vulnerabilities, native code safety, code quality, and dependency risks.
- Generate Report: Produce a structured markdown report including findings with the required fields (Issue Type Label, Severity, Location, Description, Fix).
- Output Report: Display the report and confirm completion.
Output Format
Generate a security report tailored to the context (full package vs quick check). All reports must include:
- Standardized labels from the gist.
- Severity levels (Critical, High, Medium, Low).
- Clear indications if no issues are found.
# Security Audit Report: [Package Name]
**Scope**: [audited files/directories]
## Summary
[Brief summary of findings]
## Findings
### [Issue Title]
**Issue Type**: [Label]
**Severity**: [Level]
**Location**: [file:line]
**Description**: [Details]
**Fix**: [Recommendation]
Examples
Example: Full Package Audit
User: "Run security audit on this R package"
Agent:
- Confirms scope:
DESCRIPTION, NAMESPACE, R/, src/
- Fetches gist instructions and reads files.
- Analyzes for vulnerabilities and generates report.
Output: A detailed report listing any High/Medium/Low issues, or a Clean status if no issues are found.
Reference: Security audit criteria defined at https://gist.github.com/lwaldron/0606c678e7d81b012a1b05901cf4b732
1---2name: security-audit-r-package3description: Perform comprehensive security audit of R/Bioconductor packages4---56# security-audit-r-package78Perform comprehensive security audits of R/Bioconductor packages, identifying vulnerabilities, native code security issues, code quality problems, and dependency risks.910## Usage1112Invoke this skill to audit an R package:13- "Run security audit on this R package"14- "Check this package for security vulnerabilities"15- "Security audit only the R/ directory"1617## Prerequisites1819- Working directory is an R package.20- Internet access to fetch audit instructions from the reference gist.2122## Process23241. **Determine Audit Scope**: Default is the entire package (`DESCRIPTION`, `NAMESPACE`, `R/`, `src/`). The user may specify a subset.252. **Fetch Audit Instructions**: Read the standardized security audit instructions from:26 **https://gist.github.com/lwaldron/0606c678e7d81b012a1b05901cf4b732**27 These instructions define the categories to check, standardized issue type labels, and required fields.283. **Read Files**: Read all files within the defined scope.294. **Analyze for Issues**: Review the code against the checklist defined in the gist. Address vulnerabilities, native code safety, code quality, and dependency risks.305. **Generate Report**: Produce a structured markdown report including findings with the required fields (Issue Type Label, Severity, Location, Description, Fix).316. **Output Report**: Display the report and confirm completion.3233## Output Format3435Generate a security report tailored to the context (full package vs quick check). All reports must include:36- Standardized labels from the gist.37- Severity levels (Critical, High, Medium, Low).38- Clear indications if no issues are found.3940```markdown41# Security Audit Report: [Package Name]4243**Scope**: [audited files/directories]4445## Summary46[Brief summary of findings]4748## Findings49### [Issue Title]50**Issue Type**: [Label]51**Severity**: [Level]52**Location**: [file:line]53**Description**: [Details]54**Fix**: [Recommendation]55```5657## Examples5859### Example: Full Package Audit60**User**: "Run security audit on this R package"61**Agent**:621. Confirms scope: `DESCRIPTION`, `NAMESPACE`, `R/`, `src/`632. Fetches gist instructions and reads files.643. Analyzes for vulnerabilities and generates report.65**Output**: A detailed report listing any High/Medium/Low issues, or a Clean status if no issues are found.6667---6869**Reference**: Security audit criteria defined at https://gist.github.com/lwaldron/0606c678e7d81b012a1b05901cf4b732
Bioconductor