AgentStack
Sign in Publish
MCP servers Skills Toolkits Why AgentStack Sell Docs
Sign in
SKILL verified MIT Self-run

Security Audit

skill-cobusgreyling-grok-build-arsenal-security-audit · by cobusgreyling

|

↗ Repository
— No reviews yet
0 installs
11 views
0.0% view→install

Install

$ agentstack add skill-cobusgreyling-grok-build-arsenal-security-audit

✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

  • ✓ Prompt-injection patterns
  • ✓ Secret / credential exfiltration
  • ✓ Dangerous shell & filesystem operations
  • ✓ Untrusted network calls
  • ✓ Known-malicious package signatures

What it can access

  • ✓ Network access No
  • ✓ Filesystem access No
  • ✓ Shell / process execution No
  • ✓ Environment & secrets No
  • ✓ Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

Are you the author of Security Audit? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

Security Audit

Treat every hook, MCP, and agent capability as high-risk.

Checklist (always cover these)

  • Hard-coded secrets or credentials
  • Unsafe command execution or shell injection
  • Path traversal or arbitrary file access
  • Insufficient input validation / sanitization
  • Overly broad permissions in MCP servers or hooks
  • Trust model for project-provided hooks/skills
  • Data exfiltration risks (especially in research or browser MCPs)
  • Logging of sensitive information

Process

  1. Identify the trust boundary for the change.
  2. Trace data from untrusted sources (user input, files from disk, network, session logs).
  3. Flag anything that can lead to code execution or secret access.
  4. Propose the smallest hardening changes.
  5. Recommend tests or verification steps (e.g. "try to escape the sandbox").

When Working on Meta-Tooling

Extra scrutiny for anything that will run inside other people's agent sessions (skills, MCPs, hooks in this arsenal itself).

Always pair with plan-mode-orchestrator for security-related work.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet — be the first.

Write a review

Versions

  • v0.1.0 Imported from the upstream source.

More in Agent Skills