audit— agent skill

Security Audit

Full security check across dependencies, static analysis, and code review.

Steps

1. Dependency audit:

   npx pnpm audit 2>&1

Report: number of vulnerabilities by severity. Flag any HIGH or CRITICAL as blockers.

1. Biome lint (security-relevant rules):

   npx pnpm lint 2>&1

Report any noEval, noWith, useStrictMode violations.

1. Shell injection check — scan for unsafe patterns:

   grep -rn "shell: true\|exec(\|execSync(\|spawn(" src/ --include="*.ts"

Any shell: true or execSync is a finding. exec( without File suffix is suspicious.

1. Path traversal check — scan for unguarded path joins:

   grep -rn "path\.join\|path\.resolve" src/ --include="*.ts"

Flag any that use user-controlled input without validation.

1. Input sanitization check:

   grep -rn "z\.string()" src/ --include="*.ts"

Verify all string inputs from MCP tool calls go through Zod before use.

1. PowerShell script audit — check for string interpolation:

   grep -rn '"\$' scripts/ --include="*.ps1"

Any "$variable" in PowerShell where the variable comes from user input is a finding.

1. Summary report:

   Dependencies: N vulnerabilities (H HIGH, M MEDIUM, L LOW)
   Shell injection: PASS / N findings
   Path traversal: PASS / N findings
   Input validation: PASS / N findings
   PS interpolation: PASS / N findings

   Overall: PASS / FAIL
   Blockers for release: [list]

Severity Classification

• BLOCKER (must fix before release): shell injection, path traversal, HIGH/CRITICAL npm vulns
• HIGH (fix soon): unvalidated inputs reaching business logic, MEDIUM npm vulns
• MEDIUM (track): defense-in-depth gaps, LOW npm vulns
• INFO (optional): best practice improvements