Audit Skills

Audit Skills (Premium Universal Security)

Overview

Expert security auditor for AI Skills and Bundles. Performs non-intrusive static analysis to identify malicious patterns, data leaks, system stability risks, and obfuscated payloads across Windows, macOS, Linux/Unix, and Mobile (Android/iOS). 2-4 sentences is perfect.

When to Use This Skill

• Use when you need to audit AI skills and bundles for security vulnerabilities
• Use when working with cross-platform security analysis
• Use when the user asks about verifying skill legitimacy or performing security reviews
• Use when scanning for mobile threats in AI skills

How It Works

Step 1: Static Analysis

Performs non-intrusive static analysis to identify malicious patterns, data leaks, system stability risks, and obfuscated payloads.

Step 2: Platform-Specific Threat Detection

Analyzes code for platform-specific security issues across Windows, macOS, Linux/Unix, and Mobile (Android/iOS).

1. Privilege, Ownership & Metadata Manipulation

• Elevated Access: sudo, chown, chmod, TakeOwnership, icacls, Set-ExecutionPolicy.
• Metadata Tampering: touch -t, setfile (macOS), attrib (Windows), Set-ItemProperty, chflags.
• Risk: Unauthorized access, masking activity, or making files immutable.

2. File/Folder Locking & Resource Denial

• Patterns: chmod 000, chattr +i (immutable), attrib +r +s +h, Deny ACEs in icacls.
• Global Actions: Locking or hiding folders in %USERPROFILE%, /Users/, or /etc/.
• Risk: Denial of service or data locking.

3. Script Execution & Batch Invocation

• Legacy/Batch Windows: .bat, .cmd, cmd.exe /c, vbs, cscript, wscript.
• Unix Shell: .sh, .bash, .zsh, chmod +x followed by execution.
• PowerShell: .ps1, powershell -ExecutionPolicy Bypass -File ....
• Hidden Flags: -WindowStyle Hidden, -w hidden, -noprofile.

4. Dangerous Install/Uninstall & System Changes

• Windows: msiexec /qn, choco uninstall, reg delete.
• Linux/Unix: apt-get purge, yum remove, rm -rf /usr/bin/....
• macOS: brew uninstall, deleting from /Applications.
• Risk: Removing security software or creating unmonitored installation paths.

5. Mobile Application & OS Security (Android/iOS)

• Android Tools: adb shell, pm install, am start, apktool, dex2jar, keytool.
• Android Files: Manipulation of AndroidManifest.xml (permissions), classes.dex, or strings.xml.
• iOS Tools: xcodebuild, codesign, security find-identity, fastlane, xcrun.
• iOS Files: Manipulation of Info.plist, Entitlements.plist, or Provisioning Profiles.
• Mobile Patterns: Jailbreak/Root detection bypasses, hardcoded API keys in mobile source, or sensitive permission requests (Camera, GPS, Contacts) in non-mobile skills.
• Risk: Malicious mobile package injection, credential theft from mobile builds, or device manipulation via ADB.

6. Information Disclosure & Network Exfiltration

• Patterns: curl, wget, Invoke-WebRequest, Invoke-RestMethod, scp, ftp, nc, socat.
• Sensible Data: .env, .ssh, cookies.sqlite, Keychains (macOS), Credentials (Windows), keystore (Android).
• Intranet: Scanning internal IPs or mapping local services.

7. Service, Process & Stability Manipulation

• Windows: Stop-Service, taskkill /f, sc.exe delete.
• Unix/Mac: kill -9, pkill, systemctl disable/stop, launchctl unload.
• Low-level: Direct disk access (dd), firmware/BIOS calls, kernel module management.

8. Obfuscation & Persistence

• Encoding: Base64, Hex, XOR loops, atob().
• Persistence: reg add (Run keys), schtasks, crontab, launchctl (macOS), systemd units.
• Tubes: curl ... | bash, iwr ... | iex.

9. Legitimacy & Scope (Universal)

• Registry Alignment: Cross-reference with CATALOG.md.
• Structural Integrity: Does it follow the standard repo layout?
• Healthy Scope: Does a "UI Design" skill need adb shell or sudo?

Step 3: Reporting

Generates a security report with a score (0-10), platform target identification, flagged actions, threat analysis, and mitigation recommendations.

Examples

Example 1: Security Review

"Perform a security audit on this skill bundle"

Example 2: Cross-Platform Threat Analysis

"Scan for mobile threats in this AI skill"

Best Practices

• ✅ Perform non-intrusive analysis
• ✅ Check for privilege escalation patterns
• ✅ Look for information disclosure vulnerabilities
• ✅ Analyze cross-platform threats
• ❌ Don't execute potentially malicious code during audit
• ❌ Don't modify the code being audited
• ❌ Don't ignore mobile-specific security concerns

Common Pitfalls

• Problem: Executing code during audit Solution: Stick to static analysis methods only

• Problem: Missing cross-platform threats Solution: Check for platform-specific security issues on all supported platforms

• Problem: Failing to detect obfuscated payloads Solution: Look for encoding patterns like Base64, Hex, XOR loops, and atob()

Related Skills

• @security-scanner - Additional security scanning capabilities

AGI Framework Integration

Adapted for @techwavedev/agi-agent-kit Original source: antigravity-awesome-skills

Memory-First Protocol

Cache compliance check results to avoid re-running expensive AWS API calls. Retrieve prior audit findings to track remediation progress across sessions.

# Check for prior security context before starting
python3 execution/memory_manager.py auto --query "prior security audit results for Audit Skills"

Storing Results

After completing work, store security decisions for future sessions:

python3 execution/memory_manager.py store \
  --content "Audit findings: 3 critical IAM misconfigurations found and remediated" \
  --type technical --project <project> \
  --tags audit-skills security

Multi-Agent Collaboration

Share security findings with other agents so they avoid introducing vulnerabilities in their code changes.

python3 execution/cross_agent_context.py store \
  --agent "<your-agent>" \
  --action "Completed security audit — 3 critical findings fixed, compliance score 94%" \
  --project <project>

Signed Audit Trail

All security findings are cryptographically signed with the agent's Ed25519 identity, providing tamper-proof audit logs for compliance reporting.

Semantic Cache for Compliance

Cache compliance check results (semantic_cache.py) to avoid redundant AWS API calls. Cache hit at similarity >0.92 returns prior results instantly.