# System Auditor

> Expert system auditing for security, performance, and infrastructure health. Focuses on vulnerability scanning, resource bottleneck identification, log anomaly detection, and best practice compliance. Use when this capability is needed.

- Skill: `tomevault-io/system-auditor` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/system-auditor`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/system-auditor/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/system-auditor

---


# System Auditor Skill

**Activate this skill whenever** the user requests:
- Security audit or vulnerability scan
- Performance bottleneck analysis
- Infrastructure health check
- Configuration review
- Log analysis for anomalies
- Compliance verification (best practices)

## Core Principles

**Always prioritize:**
1. **Security First** - Identify exposed secrets, loose permissions, and outdated dependencies.
2. **Evidence-Based** - Base findings on logs, metrics, and command output, not assumptions.
3. **Actionable Remediation** - Provide clear steps to fix every identified issue.
4. **Holistic View** - Consider the interaction between code, infrastructure, and configuration.

## 1. Security Auditing Protocol

### Check for Exposed Secrets
- Scan for strings like `API_KEY`, `SECRET`, `PASSWORD`, `TOKEN`.
- Verify `.env` files are in `.gitignore`.
- Scan commit history for accidental leakages if necessary.

### Dependency Vulnerabilities
- Run `npm audit`, `cargo audit`, or equivalent tools.
- Check for outdated packages with known CVEs.
- Review dependency tree for untrusted or "orphaned" packages.

### Access Control & Permissions
- Verify file permissions (especially for SSH keys and config files).
- Check for "unnecessarily privileged" processes (running as root/admin when not needed).

## 2. Performance Auditing Protocol

### Resource Monitoring
- Check CPU and Memory usage patterns.
- Identify "memory leaks" (increasing memory usage over time).
- Verify disk I/O and network latency.

### Bottleneck Identification
- Profile slow API calls or database queries.
- Check for inefficient loops or high-complexity algorithms.
- Analyze build/startup times.

## 3. Log & Infrastructure Health

### Log Analysis
- Search for `ERROR`, `CRITICAL`, or `EXCEPTION` in logs.
- Detect "anomaly patterns" (unusual spike in specific logs).
- Verify log categorization and readability.

### Infrastructure Checks
- Check health endpoints of external services (Supabase, GitHub API).
- Verify connectivity and timeout configurations.
- Audit environment variable consistency across environments.

## Output Format
Every audit report must include:
1. **Summary**: High-level status (Healthy / At Risk / Critical).
2. **Findings**: Categorized list of issues with severity levels.
3. **Evidence**: Snippets of logs, command outputs, or code.
4. **Remediation Plan**: Precise steps to resolve the findings.

**Example Severity Levels:**
- 🔴 **CRITICAL**: Immediate action required (e.g., exposed secrets).
- 🟠 **WARNING**: Action required soon (e.g., outdated dependencies).
- 🔵 **NOTICE**: Optimization suggested (e.g., slow query).

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/ultraxn) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-16 -->