Source profileQuality 71/100Review permissions

yun520-1/mark-heartflow-skill/skills/security-audit/SKILL.md

security-audit

Comprehensive security auditing for Clawdbot deployments. Scans for exposed credentials, open ports, weak configs, and vulnerabilities. Auto-fix mode included.

Source repository stars
36
Declared platforms
0
Static risk flags
1
Last source update
2026-07-28
Source checked
2026-07-28
DecisionCompatibilityInstallWorkflowPermissionsEvidenceSource

Decision brief

What it does—and where it fits

Comprehensive security auditing for Clawdbot deployments. Scans for exposed credentials, open ports, weak configs, and vulnerabilities.

Best for

  • Run a security audit to identify vulnerabilities in your Clawdbot setup before deployment or on a schedule. Use auto-fix to remediate common issues automatically.

Not for

  • Tasks that require unconfirmed production actions or broad system permissions.
  • Environments where the pinned source and install steps cannot be inspected.

Compatibility matrix

Platform support, with evidence labels

PlatformStatusEvidenceWhat to check
CodexNot declaredNo explicit evidencePortability before use
Claude CodeNot declaredNo explicit evidencePortability before use
CursorNot declaredNo explicit evidencePortability before use
Gemini CLINot declaredNo explicit evidencePortability before use
Open the compatibility checker

Installation

Inspect first. Install second.

The source command is displayed only when detected. A safe inspection prompt is always available so your agent can explain every action before execution.

Source-detected install commandSource
npx skills add https://github.com/yun520-1/mark-heartflow-skill --skill "skills/security-audit"
Safe inspection promptEditorial

Inspect the Agent Skill "security-audit" from https://github.com/yun520-1/mark-heartflow-skill/blob/20bbbb4eacf56c941ddc3420dcbc81c04d55ec5c/skills/security-audit/SKILL.md at commit 20bbbb4eacf56c941ddc3420dcbc81c04d55ec5c. List every install step, command, network request, credential, file read/write, external action, and rollback step. Explain whether it fits my task. Do not install or execute anything until I approve.

Workflow

What the source asks the agent to do

  1. 01

    Setup

    No external dependencies required. Uses native system tools where available.

    No external dependencies required. Uses native system tools where available.
  2. 02

    How to

    Review the “How to” section in the pinned source before continuing.

    Review and apply the “How to” source section.
  3. 03

    When to use

    Run a security audit to identify vulnerabilities in your Clawdbot setup before deployment or on a schedule. Use auto-fix to remediate common issues automatically.

    Run a security audit to identify vulnerabilities in your Clawdbot setup before deployment or on a schedule. Use auto-fix to remediate common issues automatically.
  4. 04

    Quick audit (common issues)

    Review the “Quick audit (common issues)” section in the pinned source before continuing.

    Review and apply the “Quick audit (common issues)” source section.

Permission review

Static risk signals and limitations

Runs scripts

medium · line 16

The documentation asks the agent to run terminal commands or scripts.

node skills/security-audit/scripts/audit.cjs

Runs scripts

medium · line 22

The documentation asks the agent to run terminal commands or scripts.

node skills/security-audit/scripts/audit.cjs --full

Evidence record

Why each signal appears

EvidenceSourceComputedTestedEditorial
SignalValueEvidence typeMeaning
Quality score71/100ComputedDocumentation, specificity, maintenance, and trust rules
Repository stars36SourceRepository attention, not individual Skill quality
Compatibility0 platformsSourceDeclared in the catalog source record
Usage guideautomated source guideEditorialGenerated or reviewed according to the visible evidence level

Pinned source

Provenance and original SKILL.md

Repository
yun520-1/mark-heartflow-skill
Skill path
skills/security-audit/SKILL.md
Commit
20bbbb4eacf56c941ddc3420dcbc81c04d55ec5c
License
Not declared
Collected
2026-07-28
Default branch
main
View the original SKILL.md

Security Audit Skill

When to use

Run a security audit to identify vulnerabilities in your Clawdbot setup before deployment or on a schedule. Use auto-fix to remediate common issues automatically.

Setup

No external dependencies required. Uses native system tools where available.

How to

Quick audit (common issues)

node skills/security-audit/scripts/audit.cjs

Full audit (comprehensive scan)

node skills/security-audit/scripts/audit.cjs --full

Auto-fix common issues

node skills/security-audit/scripts/audit.cjs --fix

Audit specific areas

node skills/security-audit/scripts/audit.cjs --credentials      # Check for exposed API keys
node skills/security-audit/scripts/audit.cjs --ports            # Scan for open ports
node skills/security-audit/scripts/audit.cjs --configs          # Validate configuration
node skills/security-audit/scripts/audit.cjs --permissions      # Check file permissions
node skills/security-audit/scripts/audit.cjs --docker           # Docker security checks

Generate report

node skills/security-audit/scripts/audit.cjs --full --json > audit-report.json

Output

The audit produces a report with:

LevelDescription
🔴 CRITICALImmediate action required (exposed credentials)
🟠 HIGHSignificant risk, fix soon
🟡 MEDIUMModerate concern
🟢 INFOFYI, no action needed

Checks Performed

Credentials

  • API keys in environment files
  • Tokens in command history
  • Hardcoded secrets in code
  • Weak password patterns

Ports

  • Unexpected open ports
  • Services exposed to internet
  • Missing firewall rules

Configs

  • Missing rate limiting
  • Disabled authentication
  • Default credentials
  • Open CORS policies

Files

  • World-readable files
  • Executable by anyone
  • Sensitive files in public dirs

Docker

  • Privileged containers
  • Missing resource limits
  • Root user in container

Auto-Fix

The --fix option automatically:

  • Sets restrictive file permissions (600 on .env)
  • Secures sensitive configuration files
  • Creates .gitignore if missing
  • Enables basic security headers

Related skills

  • security-monitor - Real-time monitoring (available separately)

Alternatives

Compare before choosing

Computed 957

event4u-app/agent-config

security-audit

ONLY when user explicitly requests: security audit, vulnerability scan, or penetration test review. NOT for regular feature work.

2026-07-280 platforms
Computed 10042,015

coreyhaines31/marketingskills

ab-testing

When the user wants to plan, design, or implement an A/B test or experiment, or build a growth experimentation program. Also use when the user mentions "A/B test," "split test," "experiment," "test this change," "variant copy," "multivariate test," "hypothesis," "should I test this," "which version is better," "test two versions," "statistical significance," "how long should I run this test," "growth experiments," "experiment velocity," "experiment backlog," "ICE score," "experimentation program

2026-07-270 platforms
Computed 10042,015

coreyhaines31/marketingskills

churn-prevention

When the user wants to reduce churn, build cancellation flows, set up save offers, recover failed payments, or implement retention strategies. Also use when the user mentions 'churn,' 'cancel flow,' 'offboarding,' 'save offer,' 'dunning,' 'failed payment recovery,' 'win-back,' 'retention,' 'exit survey,' 'pause subscription,' 'involuntary churn,' 'people keep canceling,' 'churn rate is too high,' 'how do I keep users,' or 'customers are leaving.' Use this whenever someone is losing subscribers o

2026-07-270 platforms
Computed 997

event4u-app/agent-config

design-review

Use when the user says "review the design", "check the UI", or wants a comprehensive UI/UX review. Uses a 7-phase methodology covering interaction, responsiveness, accessibility, and more.

2026-07-280 platforms