# Security Audit

> Perform focused security reviews on code, diffs, hooks, and MCP servers. Look for auth issues, injection, secret leakage, unsafe tool/MCP usage, and hook risks. Use for any change involving external input, credentials, or agent capabilities. Triggers: "security review", "audit this diff", "check for vulnerabilities".

- Skill: `cobusgreyling/security-audit` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cobusgreyling/security-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cobusgreyling/security-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: cobusgreyling (https://skillmd.com/u/cobusgreyling)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cobusgreyling/security-audit

---


# Security Audit

Treat every hook, MCP, and agent capability as high-risk.

## Checklist (always cover these)

- Hard-coded secrets or credentials
- Unsafe command execution or shell injection
- Path traversal or arbitrary file access
- Insufficient input validation / sanitization
- Overly broad permissions in MCP servers or hooks
- Trust model for project-provided hooks/skills
- Data exfiltration risks (especially in research or browser MCPs)
- Logging of sensitive information

## Process

1. Identify the trust boundary for the change.
2. Trace data from untrusted sources (user input, files from disk, network, session logs).
3. Flag anything that can lead to code execution or secret access.
4. Propose the smallest hardening changes.
5. Recommend tests or verification steps (e.g. "try to escape the sandbox").

## When Working on Meta-Tooling

Extra scrutiny for anything that will run inside other people's agent sessions (skills, MCPs, hooks in this arsenal itself).

Always pair with `plan-mode-orchestrator` for security-related work.