# Security Audit

> Use when checking auth, secrets, permissions and security-sensitive code.

- Skill: `vinilana/security-audit-3` (Agent Skill)
- Install (CLI): `npx skillmds@latest add vinilana/security-audit-3`
- Raw SKILL.md: https://api.skillmd.com/api/skills/vinilana/security-audit-3/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: vinilana (https://skillmd.com/u/vinilana)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/vinilana/security-audit-3

---


# Security Audit

## Procedure

1. Confirm the task scope and active PREVC phase.
2. Load the relevant project docs from `.context/docs/`.
3. Apply the checklist below to the specific files in scope.
4. Capture validation evidence and unresolved risks.

## Checklist

- Use repository-specific conventions, not generic defaults.
- Reference concrete files, commands and outputs.
- Keep recommendations actionable and prioritized.
- If information is missing, inspect the codebase first, then ask a focused question only when needed.

## Project Notes

- Use this skill against a pi-extension codebase with TypeScript as the primary language.
- Review any change that expands filesystem reads/writes, shell execution, package mutation or git operations.
- Review custom tool schemas, input preparation and returned details for compatibility and safety.
- Review event hooks for fail-open behavior and unintended prompt/session mutation.

## Useful Context

- `.context/docs/project-overview.md`
- `.context/docs/development-workflow.md`
- `.context/docs/architecture.md`
- `.context/docs/security.md`
- `.context/docs/data-flow.md`
- `.context/docs/contributing.md`
- `.context/docs/testing-strategy.md`
- `.context/docs/api.md`