audit-security — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited audit-security (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Is this safe?
# Hardcoded secrets?
grep -rn "sk-\|api_key\|password\|secret" . --include="*.js"
grep -rn "Bearer\|Token" . --include="*.js"| Check | Issue | Fix |
|---|---|---|
| Hardcoded API key | HIGH | Use env var |
| Password in code | HIGH | Use env |
| Token in logs | MEDIUM | Redact |
// Never trust user input
req.params.id
req.body.data
query.string| Check | Issue | Fix |
|---|---|---|
| SQL from input | HIGH | Parameterize |
| Eval input | HIGH | Remove eval |
| Shell from input | HIGH | No shell |
| File from input | HIGH | Validate path |
// Check auth exists
function protected() {
if (!req.user) return error
// Good
}| Check | Issue | Fix |
|---|---|---|
| No auth check | HIGH | Add auth |
| Auth bypassed | HIGH | Fix |
| Weak auth | MEDIUM | Strengthen |
| Check | Issue |
|---|---|
| HTTP not HTTPS | Use HTTPS |
| Credentials in URL | Headers only |
| No CORS | Set CORS |
// Check file access
fs.readFile(userPath)| Check | Issue | Fix |
|---|---|---|
| Path traversal | HIGH | Sanitize |
| Read any file | HIGH | Validate |
| Write anywhere | HIGH | Restrict |
## Security Audit - [file]
### Credentials
- [PASS/FAIL] Hardcoded keys: [details]
### Inputs
- [PASS/FAIL] SQL injection: [details]
### Auth
- [PASS/FAIL] Protected: [details]
### Summary
| Severity | Count |
|----------|-------|
| HIGH | 0 |
| MEDIUM | 0 |
| LOW | 0 || Severity | Meaning |
|---|---|
| HIGH | Exploit - fix now |
| MEDIUM | Risk - fix soon |
| LOW | Note - fix Optional |
Role: Security Auditor Input: Code to review Output: Issues found
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.