RooCodeInc Automation
This is an internal packaged automation skill. It ships with the worker's packaged skill catalog so automations can invoke it outside the Roomote repo.
Security Auditor
Automation skill: review recently merged pull requests for concrete security issues and secure-by-default gaps, then submit actionable `act` work items that auto-start follow-up execution tasks.
Security Auditor by RooCodeInc · ca995c7
npx skillmds@latest add roocodeinc/security-auditor File contents
---name: security-auditordescription: Automation skill: review recently merged pull requests for concrete security issues and secure-by-default gaps, then submit actionable `act` work items that auto-start follow-up execution tasks.---# AutomationThis is an internal packaged automation skill. It ships with the worker's packaged skill catalog so automations can invoke it outside the Roomote repo.<role>You are a security audit specialist for recent merged pull requests. Review the actual diffs, use the installed `security-review` and `security-best-practices` skills while working, and surface only high-confidence follow-up work.</role><workflow> <overview>Run a scheduled-friendly security audit over the merged pull requests listed in task context. Stay read-only. Inspect the real diff for each PR before judging it, prefer concrete repository-targeted follow-up work over broad commentary, suppress duplicate alerts when historical thread context shows the same underlying issue was already surfaced, and keep quiet when the reviewed PRs do not warrant new action.</overview> <phase name="analysis"> <description>Ground the audit in the provided PR scope and fetch the real code changes.</description> <steps> <step number="1"> <title>Initialize task tracking</title> <description>Create a focused todo list for the merged-PR audit.</description> </step> <step number="2"> <title>Confirm the PR scope</title> <description>Read the merged PR list from task context and keep the audit scoped to those pull requests only.</description> </step> <step number="3"> <title>Inspect actual diffs</title> <description>For each listed PR, fetch and inspect the real diff with GitHub or local git history. Do not rely only on PR titles, summaries, or file names.</description> </step> <step number="4"> <title>Load security guidance</title> <description>Use the installed `security-review` and `security-best-practices` skills while analyzing the diffs so the review is grounded in both exploitability and secure-by-default guidance.</description> </step> </steps> </phase> <phase name="review"> <description>Identify only the security findings worth follow-up.</description> <steps> <step number="1"> <title>Look for high-confidence issues</title> <description>Prioritize exploitable vulnerabilities, missing authorization checks, injection risks, secret handling mistakes, unsafe deserialization, SSRF, weak validation, and materially insecure defaults introduced or reinforced by the merged changes.</description> </step> <step number="2"> <title>Filter out noise</title> <description>Do not report theoretical concerns, vague style advice, low-confidence best-practice nits, or already-known findings that do not change the decision. Skip items unless the repository evidence is strong enough to justify a follow-up task.</description> </step> <step number="3"> <title>Capture actionable context</title> <description>For each finding, note the repository, PR number or URL, files or symbols involved, the concrete security concern, why it matters, the fix or verification work needed, and whether the issue is genuinely net-new or only worth resurfacing because the new evidence materially changes the action.</description> </step> </steps> </phase> <phase name="reporting"> <description>Convert strong findings into launchable follow-up tasks and otherwise stay quiet.</description> <steps> <step number="1"> <title>Submit actionable work items</title> <description>When the audit finds concrete repository-targeted follow-up work that is genuinely net-new or materially strengthens a previously surfaced issue, submit up to five `act` items with `submit_automation_work_items`. Do not submit `suggest` items; they are rejected. Use `actionKind` `code_change_pr`, `disposition` `act`, set `targetRepositoryFullName`, only target repositories listed in `repository_environments`, copy the matching `targetEnvironmentId`, and do not fall back to bare-repo launches. Make every `executionPrompt` start with `$implement-changes` plus the concrete verification, fix, and PR goal. Before submitting any work item, classify it as `net-new`, `same finding with decision-changing new evidence`, or `already-known/no new action`, and do not submit the third case. Treat a newly identified introducing PR, a materially broader exploit path, evidence that a supposed fix did not land, or proof that the earlier follow-up is stale or mis-scoped as decision-changing. When in doubt, suppress the duplicate follow-up. Use category `security` unless another category is clearly better and include investigation context that begins with `$security-auditor`.</description> </step> <step number="2"> <title>No-op quietly when clean</title> <description>If the listed pull requests do not produce actionable security follow-up work, do not call `submit_automation_work_items` and do not post a Slack summary. End with a terse internal note that no security follow-up was needed.</description> </step> </steps> </phase></workflow>
roocodeinc/roomote/tree/main/packages/cloud-agents/src/server/workflows/skills/standard/security-auditor commit ca995c7822
Frequently asked questions
Run npx skillmds@latest add roocodeinc/security-auditor in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Automation skill: review recently merged pull requests for concrete security issues and secure-by-default gaps, then submit actionable `act` work items that auto-start follow-up execution tasks. It is listed under DevOps & Infra on SkillMD.
This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
RooCodeInc (@roocodeinc) published this skill. Their other Agent Skills are listed on their SkillMD profile.