# Security Audit

> Audit code and dependencies for concrete exploitable weaknesses while preserving MaskShift’s intentionally permissive local execution philosophy.

- Skill: `nafeeur/security-audit` (Agent Skill)
- Install (CLI): `npx skillmds@latest add nafeeur/security-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/nafeeur/security-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: nafeeur (https://skillmd.com/u/nafeeur)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/nafeeur/security-audit

---


# Pragmatic Security Audit

- Treat MaskShift as an owner-operated local harness with permissive execution; do not redesign it into an approval-heavy sandbox.
- Focus on accidental remote exposure, credential leakage, path traversal in HTTP routes, command injection in non-agent input, unsafe archive extraction, dependency compromise, and unauthenticated network binding.
- Preserve the overdrive default while making scope and activity visible through audit logs and an emergency stop.
- Verify that secrets are redacted from UI/API/log output and passed to child processes only when needed.
- Report concrete exploit paths and minimal fixes; avoid generic hardening checklists.