# Security Research Audit

> Audits software components for CVEs, exposed secrets, insecure configurations, and dependency risks.

- Skill: `robertoatila/security-research-audit` (Agent Skill)
- Install (CLI): `npx skillmds@latest add robertoatila/security-research-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/robertoatila/security-research-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: robertoatila (https://skillmd.com/u/robertoatila)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/robertoatila/security-research-audit

---


# Security Research Audit

Perform structured, non-destructive security research and dependency vulnerability audits
across project repositories, components, and libraries.
This workflow operates in strict read-only mode: automated exploit execution against live systems
is strictly prohibited.

## Golden rules

- **Read-Only / Non-Destructive Inspection**: Scan code, manifests, and configs for vulnerabilities. Never execute live attack payloads or unauthorized pen-testing.
- **Evidence is Mandatory**: Store vulnerability reports, dependency trees, and CVE citations under `${EVIDENCE_DIR:-.evidence/security-audit}/<slug>/`.
- **Zero Host Pollution**: Never install unverified global binaries or third-party scanner packages outside isolated project sandboxes.
- **Actionable Remediation**: Every identified CVE or risk must specify: Affected Component, Severity (CVSS), Vector, and Remediated Version.

## Execution Router

| Audit Target | Tool / Command | Output Artifact |
|---|---|---|
| Node / JavaScript Dependencies | `npm audit --json` or `pnpm audit` | `npm-audit-findings.json` |
| Python Dependencies | `pip-audit --format json` | `python-audit-findings.json` |
| Rust / Cargo Dependencies | `cargo audit --json` | `cargo-audit-findings.json` |
| Secrets & API Keys | Git history & regex pattern scan | `secrets-scan-report.md` |
| Code & Configuration Risks | Static analysis / SAST rules | `sast-vulnerability-matrix.md` |

## Remediation Checklist

1. Verify false-positive status against upstream CVE advisories.
2. Formulate minimal non-breaking dependency upgrades.
3. Validate build and test suites after version patching.