Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Audit a codebase or directory for security issues (hardcoded secrets, injection, unsafe deserialization, weak crypto, authz gaps) and produce a structured findings report. Use when the user asks for a security review, an audit, or to check code for vulnerabilities. Report only — never fix.
| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-04 | ✗→✓ | ▲ Improved | 380% | 0% |
| case-12 | ✓→✗ | ▼ Worse | -81% | 0% |
| case-13 | ✓→✗ | ▼ Worse | -27% | 0% |
| case-16 | ✓→✗ | ▼ Worse | -71% | 0% |
| case-17 | ✓→✗ | ▼ Worse | -12% | 0% |
Identify what to audit (a directory, a diff, a module). Gather it yourself with sys_os_ / git — this is plumbing, not investigation.
Hand the scanner the scope; it reads source, manifests, history and returns per-finding evidence. Do NOT sprawl across the repo yourself.
For each finding:
### <Severity>: <short title>
Route the draft through the reviewer (codex, different vendor) to confirm true positives and drop false positives. Fold in its verdicts.
Present the final report. You REPORT; you never edit, patch, or fix code.
Other measured skills in the registry, with their headline benchmark lift.