Niro — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Niro (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Push a PR. Niro hacks it. Your agent patches it.
>
Security that keeps pace with AI-speed shipping — found and fixed before you merge.
A PR adds a saved-search feature to your app. Niro reports 4 cross-tenant data leaks in under 6 minutes for $2.84 in model spend. Your coding agent writes a regression test for each, patches the code, and re-runs Niro to verify the fix. The PR goes green.
That's the loop.
returns each finding with the exact HTTP request that proved it.
Niro to re-verify.
Your AI agent ships code in minutes. Security testing takes days — if it happens at all. Niro closes that gap: testing runs in the same loop as the code, before CI finishes. No Jira ticket. No triage queue.
You review a clean PR.
Most pentests stall before testing starts. The app needs realistic users, tenants, resources, webhooks, integrations, feature flags, and product state before meaningful bugs are reachable.
Niro turns that setup work into an agent loop. Your coding agent prepares the context, Niro reports what is still missing, and the agent fills the gaps and re-runs. The developer stays in review mode instead of manually building a pentest harness.
Both are commitments, not averages — they're the floor the product is engineered around.
Niro orchestrates tools you already use — it doesn't bundle them. You'll need:
Need GitLab, Cursor, or something else? Open an issue — we prioritize by demand. Runs on macOS, Linux, and Windows.
macOS, Linux:
curl -fsSL https://raw.githubusercontent.com/apxlabs-ai/niro/main/install.sh | shWindows (PowerShell):
irm https://raw.githubusercontent.com/apxlabs-ai/niro/main/install.ps1 | iexFrom the root of your repo:
niro initThis scaffolds a niro/ directory and wires Niro into your coding agent as an MCP server. Your agent decides when to call it from there — typically right before a push.
Commit the `niro/` directory and agent wiring (.mcp.json, .claude/, etc.) so your whole team inherits the setup on the next pull — no one else needs to run niro init.
[!TIP] Want to evaluate Niro on a whole application and have your agent open fix PRs? See Full Pentest to Fix PRs.
only reachable endpoints are the targets you list in niro/scope.yaml.
Code, GitHub Copilot, or OpenAI Codex — and lets it do the reasoning. Your agent calls its LLM provider directly using the credentials already in your shell. Niro doesn't have an API key and doesn't see yours. The bill arrives on your provider account.
event. See TELEMETRY.md for the full details and how to turn it off.
Apache License 2.0 (LICENSE, NOTICE). Install, run, redistribute, and build on Niro freely.
<https://github.com/apxlabs-ai/niro/issues>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.