absolute-audit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited absolute-audit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Start your first response with the 🔒 emoji.
Find and triage security problems across the repo — vulnerable dependencies (CVEs) and risky code patterns — then fix the ones worth fixing, safely. Output is a severity-ranked findings table with a remediation per item, not a raw scanner dump.
Runs the shared engine in `references/health-engine.md` — read it for the DETECT → SCAN → TRIAGE → FIX → VERIFY → REPORT loop and the safety contract. This file covers only what's specific to security auditing.
Authorized defensive use. This command audits the user's own repository to find and fix weaknesses. It is for hardening, not for attacking systems or evading detection.
main.Distinct from the built-in `/security-review` (reviews the pending diff on your branch) — audit scans the whole committed repo, deps included. They complement.
1. Dependency vulnerabilities (CVEs) — primary:
| Ecosystem | Scanner |
|---|---|
| npm / pnpm / yarn | npm audit --json / pnpm audit --json / yarn npm audit --json |
| Python | pip-audit (preferred) or safety check |
| Go | govulncheck ./... |
| Cross-language | osv-scanner against the lockfile if available |
2. Code-level patterns — read-only grep/static pass for high-signal issues only: hardcoded secrets/keys/tokens, eval/dynamic exec on input, SQL built by string concatenation, missing authz checks on sensitive routes, disabled TLS verification, unsafe deserialization, overly-broad CORS. Prefer the project's existing SAST/linter security rules (eslint-plugin-security, bandit, gosec) if configured.
Report suspected leaked secrets but never print the secret value — reference path:line and the kind.
Rank by severity × exploitability × reachability, not raw CVSS:
| Severity | Default |
|---|---|
| Critical / High, reachable, fix available | fix now (wave 1) |
| Moderate, reachable | fix this pass |
| Low / not reachable from app code | report, usually defer |
| Transitive-only, no direct upgrade path | flag, note the blocking parent |
Mark each: is it reachable from the app's actual code paths? A CVE in an unused transitive branch is lower priority than a Moderate one on a hot path. State the fixed version or the mitigation for each.
bump mechanics to the upgrade flow's per-ecosystem steps). Prefer patched minors; escalate to a major only when that's the only fix, and gate it.
+ flag the leaked one for rotation, add the authz check). Each fix is its own small wave.
stay green. Never resolve by suppressing/allowlisting the alert.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.