absolute-audit

Name: absolute-audit
Author: maddhruv

199stars32forks

How to install absolute-audit?

maddhruv/absolute/absolute-audit

$npx -y skills add maddhruv/absolute --skill absolute-audit

Installs into the current project.

Summary

Vulnerability and security scan (defensive, your own repo): dependency CVEs plus risky code patterns (secrets, injection, weak authz), severity x reachability triaged and remediated without suppressing. Complements the built-in /security-review. Triggers on "absolute audit", "sec

Files · 1

View on GitHub

SKILL.md

1	> Start your first response with the 🔒 emoji.
2
3	## Absolute Audit
4
5	Find and triage security problems across the repo — vulnerable dependencies (CVEs) and
6	risky code patterns — then fix the ones worth fixing, safely. Output is a severity-ranked
7	findings table with a remediation per item, not a raw scanner dump.
8
9	Runs the shared engine in `references/health-engine.md` — read it for the
10	DETECT → SCAN → TRIAGE → FIX → VERIFY → REPORT loop and the safety contract. This file
11	covers only what's specific to security auditing.
12
13	> Authorized defensive use. This command audits the user's own repository to find
14	> and fix weaknesses. It is for hardening, not for attacking systems or evading detection.
15
16	---
17
18	## When to use
19
20	- "Run a security audit", "are we vulnerable?", "check our deps for CVEs".
21	- After a CVE disclosure affecting something you use.
22	- Periodic hygiene on `main`.
23
24	Distinct from the built-in `/security-review` (reviews the pending diff on your
25	branch) — `audit` scans the whole committed repo, deps included. They complement.
26
27	---
28
29	## What it scans
30
31	1. Dependency vulnerabilities (CVEs) — primary:
32
33	\| Ecosystem \| Scanner \|
34	\|---\|---\|
35	\| npm / pnpm / yarn \| `npm audit --json` / `pnpm audit --json` / `yarn npm audit --json` \|
36	\| Python \| `pip-audit` (preferred) or `safety check` \|
37	\| Go \| `govulncheck ./...` \|
38	\| Cross-language \| `osv-scanner` against the lockfile if available \|
39
40	2. Code-level patterns — read-only grep/static pass for high-signal issues only:
41	hardcoded secrets/keys/tokens, `eval`/dynamic exec on input, SQL built by string
42	concatenation, missing authz checks on sensitive routes, disabled TLS verification, unsafe
43	deserialization, overly-broad CORS. Prefer the project's existing SAST/linter security
44	rules (`eslint-plugin-security`, `bandit`, `gosec`) if configured.
45
46	Report suspected leaked secrets but never print the secret value — reference
47	`path:line` and the kind.
48
49	---
50
51	## Risk ranking (TRIAGE)
52
53	Rank by severity × exploitability × reachability, not raw CVSS:
54
55	\| Severity \| Default \|
56	\|---\|---\|
57	\| Critical / High, reachable, fix available \| fix now (wave 1) \|
58	\| Moderate, reachable \| fix this pass \|
59	\| Low / not reachable from app code \| report, usually defer \|
60	\| Transitive-only, no direct upgrade path \| flag, note the blocking parent \|
61
62	Mark each: is it reachable from the app's actual code paths? A CVE in an unused transitive
63	branch is lower priority than a Moderate one on a hot path. State the fixed version or the
64	mitigation for each.
65
66	---
67
68	## Fix & verify
69
70	- Dep CVEs → resolve via the smallest version move that clears it (delegate the actual
71	bump mechanics to the `upgrade` flow's per-ecosystem steps). Prefer patched minors;
72	escalate to a major only when that's the only fix, and gate it.
73	- Code issues → apply the concrete fix (parameterize the query, move the secret to env
74	+ flag the leaked one for rotation, add the authz check). Each fix is its own small wave.
75	- After each wave, re-run the scanner: the finding must actually disappear, and tests/build
76	stay green. Never resolve by suppressing/allowlisting the alert.
77	- Leaked live secrets: flag for rotation — removing from code doesn't undo exposure.
78
79	---
80
81	## Gotchas
82
83	1. Audit fatigue → blanket ignore. Triage by reachability instead of muting the scanner.
84	2. Fixing a CVE by suppressing it. An allowlisted advisory is still a vulnerability.
85	3. Printing the secret. Reference location + type only; never echo the value.
86	4. Deleting a secret from code ≠ safe. It's in git history and was exposed — rotate it.
87	5. Stopping at deps. Many real issues are in code, not the dependency tree — run both passes.
88
89	---
90
91	## Companion commands
92
93	- `/absolute upgrade` — does the actual version moves for vulnerable deps.
94	- `/security-review` (built-in) — pair with this to also cover your pending diff.
95	- `/absolute work` — if remediation is a real refactor (e.g. replacing an auth flow), hand off.

People who liked this also viewed

6 picks

Type

absolute-audit

199stars32forks

View on GitHub

How to install absolute-audit?

maddhruv/absolute/absolute-audit

$npx -y skills add maddhruv/absolute --skill absolute-audit

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	> Start your first response with the 🔒 emoji.
2
3	## Absolute Audit
4
5	Find and triage security problems across the repo — vulnerable dependencies (CVEs) and
6	risky code patterns — then fix the ones worth fixing, safely. Output is a severity-ranked
7	findings table with a remediation per item, not a raw scanner dump.
8
9	Runs the shared engine in `references/health-engine.md` — read it for the
10	DETECT → SCAN → TRIAGE → FIX → VERIFY → REPORT loop and the safety contract. This file
11	covers only what's specific to security auditing.
12
13	> Authorized defensive use. This command audits the user's own repository to find
14	> and fix weaknesses. It is for hardening, not for attacking systems or evading detection.
15
16	---
17
18	## When to use
19
20	- "Run a security audit", "are we vulnerable?", "check our deps for CVEs".
21	- After a CVE disclosure affecting something you use.
22	- Periodic hygiene on `main`.
23
24	Distinct from the built-in `/security-review` (reviews the pending diff on your
25	branch) — `audit` scans the whole committed repo, deps included. They complement.
26
27	---
28
29	## What it scans
30
31	1. Dependency vulnerabilities (CVEs) — primary:
32
33	\| Ecosystem \| Scanner \|
34	\|---\|---\|
35	\| npm / pnpm / yarn \| `npm audit --json` / `pnpm audit --json` / `yarn npm audit --json` \|
36	\| Python \| `pip-audit` (preferred) or `safety check` \|
37	\| Go \| `govulncheck ./...` \|
38	\| Cross-language \| `osv-scanner` against the lockfile if available \|
39
40	2. Code-level patterns — read-only grep/static pass for high-signal issues only:
41	hardcoded secrets/keys/tokens, `eval`/dynamic exec on input, SQL built by string
42	concatenation, missing authz checks on sensitive routes, disabled TLS verification, unsafe
43	deserialization, overly-broad CORS. Prefer the project's existing SAST/linter security
44	rules (`eslint-plugin-security`, `bandit`, `gosec`) if configured.
45
46	Report suspected leaked secrets but never print the secret value — reference
47	`path:line` and the kind.
48
49	---
50
51	## Risk ranking (TRIAGE)
52
53	Rank by severity × exploitability × reachability, not raw CVSS:
54
55	\| Severity \| Default \|
56	\|---\|---\|
57	\| Critical / High, reachable, fix available \| fix now (wave 1) \|
58	\| Moderate, reachable \| fix this pass \|
59	\| Low / not reachable from app code \| report, usually defer \|
60	\| Transitive-only, no direct upgrade path \| flag, note the blocking parent \|
61
62	Mark each: is it reachable from the app's actual code paths? A CVE in an unused transitive
63	branch is lower priority than a Moderate one on a hot path. State the fixed version or the
64	mitigation for each.
65
66	---
67
68	## Fix & verify
69
70	- Dep CVEs → resolve via the smallest version move that clears it (delegate the actual
71	bump mechanics to the `upgrade` flow's per-ecosystem steps). Prefer patched minors;
72	escalate to a major only when that's the only fix, and gate it.
73	- Code issues → apply the concrete fix (parameterize the query, move the secret to env
74	+ flag the leaked one for rotation, add the authz check). Each fix is its own small wave.
75	- After each wave, re-run the scanner: the finding must actually disappear, and tests/build
76	stay green. Never resolve by suppressing/allowlisting the alert.
77	- Leaked live secrets: flag for rotation — removing from code doesn't undo exposure.
78
79	---
80
81	## Gotchas
82
83	1. Audit fatigue → blanket ignore. Triage by reachability instead of muting the scanner.
84	2. Fixing a CVE by suppressing it. An allowlisted advisory is still a vulnerability.
85	3. Printing the secret. Reference location + type only; never echo the value.
86	4. Deleting a secret from code ≠ safe. It's in git history and was exposed — rotate it.
87	5. Stopping at deps. Many real issues are in code, not the dependency tree — run both passes.
88
89	---
90
91	## Companion commands
92
93	- `/absolute upgrade` — does the actual version moves for vulnerable deps.
94	- `/security-review` (built-in) — pair with this to also cover your pending diff.
95	- `/absolute work` — if remediation is a real refactor (e.g. replacing an auth flow), hand off.

People who liked this also viewed

6 picks

Type