security-audit-standard — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited security-audit-standard (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Methodology derived from production security audits.
Scan for hardcoded credentials in tracked source files.
Targets:
- API keys, tokens, passwords in source (not .env)
- Webhook URLs with tokens
- Database connection strings
- Private keys, certificates
- obfstr!() usage (Rust): still in binary, just obfuscatedCheck patterns:
grep -rn "sk-" "pk_" "ghp_" "token" "secret" "password" "apikey"
grep -rn "https://discord.com/api/webhooks/"
grep -rn "https://hooks.slack.com/"
grep -rn "mongodb://" "postgresql://" "redis://"Verify .gitignore covers: .env*, *.pem, *.key, credentials*, secrets*, auth*.json, config.json (if it contains secrets).
For every endpoint/command that accepts user input:
Checklist:
../)exp claim)state parameter (CSRF protection)* in production)HttpOnly, Secure, SameSite flags settempfile crate, mkstemp)# Node.js
npm audit
pnpm audit
# Rust
cargo audit
cargo deny check
# Python
pip-audit
safety check
# Go
govulncheck ./...Check for:
| Check | Command / File | Why |
|---|---|---|
| Lockfile committed | package-lock.json, Cargo.lock, go.sum, Package.resolved | Pin transitive dep versions |
| GitHub Actions pinned to SHA | uses: actions/checkout@<sha> | @v4 tag can be moved by attacker |
| Install scripts disabled in CI | npm ci --ignore-scripts | Prevents postinstall RCE |
| Provenance or signing | npm publish --provenance, sigstore for releases | Lets consumers verify origin |
| Allow-list of registries | .npmrc registry=, cargo index | Blocks dependency confusion |
| # | Vulnerability | Check |
|---|---|---|
| A01 | Broken Access Control | Every endpoint verifies auth + authz? |
| A02 | Cryptographic Failures | Using strong algorithms? Secrets encrypted at rest? |
| A03 | Injection | All inputs parameterized/escaped? |
| A04 | Insecure Design | Threat model exists? Security requirements documented? |
| A05 | Security Misconfiguration | Default creds removed? Error handling configured? |
| A06 | Vulnerable Components | Dependencies audited? No known CVEs? |
| A07 | Auth Failures | Brute force protected? MFA available? |
| A08 | Data Integrity Failures | Updates verified (checksums)? CI/CD secured? |
| A09 | Logging Failures | Security events logged? Logs don't contain secrets? |
| A10 | SSRF | Server-side requests validated? Internal URLs blocked? |
tauri.conf.json restricts script-src and connect-srcdangerous-api features disabled unless explicitly needed# Security Audit: [Project Name]
Date: YYYY-MM-DD
## Summary
- Critical: N findings
- High: N findings
- Medium: N findings
- Low: N findings
## Critical Findings
### [CRIT-01] Hardcoded API key in tracked source
- **Location**: `src/config.json:15`
- **Risk**: Key exposure if repo made public or cloned
- **Fix**: Move to .env, add to .gitignore, rotate key
- **Effort**: 5 minutes
## High Findings
...
## Recommendations
1. [Priority-ordered action items]Severity levels:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.