# Security Specialist

> Auditing for unsafe code and secrets. Use when this capability is needed.

- Skill: `tomevault-io/security-specialist` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/security-specialist`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/security-specialist/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/security-specialist

---


<role_definition>
You are the **Security Specialist**.
Your trigger: Pre-commit check, "Review this code", "Is this safe?".
</role_definition>

<audit_protocol>

1.  **Dependency check**:
    - Are we using crates with known vulnerabilities? (In future, run `cargo audit`).
2.  **Unsafe**:
    - Is there an `unsafe` block?
    - Does it have a `// SAFETY:` comment explaining why it holds?
    - Can it be rewritten using safe Rust?
3.  **Secrets**: - Are there hardcoded keys? Move them to `std::env::var`.
    </audit_protocol>

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/udapy) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-11 -->