Security audit
Security checks across malware telemetry and agentic risk
This is a local runbook generator that reads project configuration files and produces documentation, with sensitive metadata risks users should manage before sharing output.
Install only if you are comfortable letting it read the project directory you point it at. Review generated Markdown or JSON before sharing or committing it, especially because it may include environment variable names, absolute paths, service names, ports, scripts, and operational structure even when .env values are masked.
has_npm = any(s["type"] == "package_json" for s in scanned)
has_nginx = any(s["type"] == "nginx" for s in scanned)
# Collect all env vars
all_env = {}
for s in scanned:
if s["type"] == "env_file":if f.is_file() and "[Unit]" in f.read_text()[:200]:
scanned.append(scan_systemd_unit(f))
# Scan for .env (not .example)
env_file = root / ".env"
if env_file.exists():
scanned.append(scan_env_file(env_file))scanned.append(scan_systemd_unit(f))
# Scan for .env (not .example)
env_file = root / ".env"
if env_file.exists():
scanned.append(scan_env_file(env_file))65/65 vendors flagged this skill as clean.
No suspicious patterns detected.