Security audit
Security checks for vulnerabilities and agentic risk
This is a release-audit checklist skill that reads project metadata and reports risks, with no hidden persistence, destructive behavior, or exfiltration evident.
Install only if you want an advisory release checklist that can inspect the current repository and optionally query npm/GitHub status through local tools. Treat its output as a review aid, not a guaranteed release gate; run your real test suite and CI enforcement separately, and avoid network-dependent checks in sensitive offline environments unless approved.
The skill description promises it will 'verify tests pass' and 'block releases', but the documented test check explicitly avoids running tests and only detects whether test infrastructure exists. This can create a false sense of release assurance, allowing untested builds to be treated as release-ready in human or CI workflows.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
--type-not binary -i 2>/dev/null | \
grep -v "process\.env\|os\.environ\|os\.getenv\|\.env\|example\|sample\|template\|test\|mock\|fake\|dummy" | head -10
# Check .env files are gitignored
if [ -f ".env" ]; then
if git check-ignore .env >/dev/null 2>&1; then
echo "✅ .env is gitignored"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
--type-not binary -i 2>/dev/null | \
grep -v "process\.env\|os\.environ\|os\.getenv\|\.env\|example\|sample\|template\|test\|mock\|fake\|dummy" | head -10
# Check .env files are gitignored
if [ -f ".env" ]; then
if git check-ignore .env >/dev/null 2>&1; then
echo "✅ .env is gitignored"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
--type-not binary -i 2>/dev/null | \
grep -v "process\.env\|os\.environ\|os\.getenv\|\.env\|example\|sample\|template\|test\|mock\|fake\|dummy" | head -10
# Check .env files are gitignored
if [ -f ".env" ]; then
if git check-ignore .env >/dev/null 2>&1; then
echo "✅ .env is gitignored"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
--type-not binary -i 2>/dev/null | \
grep -v "process\.env\|os\.environ\|os\.getenv\|\.env\|example\|sample\|template\|test\|mock\|fake\|dummy" | head -10
# Check .env files are gitignored
if [ -f ".env" ]; then
if git check-ignore .env >/dev/null 2>&1; then
echo "✅ .env is gitignored"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
--type-not binary -i 2>/dev/null | \
grep -v "process\.env\|os\.environ\|os\.getenv\|\.env\|example\|sample\|template\|test\|mock\|fake\|dummy" | head -10
# Check .env files are gitignored
if [ -f ".env" ]; then
if git check-ignore .env >/dev/null 2>&1; then
echo "✅ .env is gitignored"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
--type-not binary -i 2>/dev/null | \
grep -v "process\.env\|os\.environ\|os\.getenv\|\.env\|example\|sample\|template\|test\|mock\|fake\|dummy" | head -10
# Check .env files are gitignored
if [ -f ".env" ]; then
if git check-ignore .env >/dev/null 2>&1; then
echo "✅ .env is gitignored"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
grep -v "process\.env\|os\.environ\|os\.getenv\|\.env\|example\|sample\|template\|test\|mock\|fake\|dummy" | head -10
# Check .env files are gitignored
if [ -f ".env" ]; then
if git check-ignore .env >/dev/null 2>&1; then
echo "✅ .env is gitignored"
else
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
fi
git ls-files '.env' '.env' 2>/dev/null | grep -v '.env.example|.env.sample|.env.template' | while read f; do echo "⚠️ Committed env file: $f" done
The headline description claims the skill 'blocks releases that aren't ready', but the body primarily provides advisory checks, sample output, and manual interpretation rather than an implemented blocking mechanism. This mismatch can cause operators to trust a control that is not actually enforcing policy.
The skill omits a clear warning that some checks make outbound calls, such as npm audit, npm outdated, and gh run list. In restricted or sensitive environments, unexpected network access can leak metadata about the project or violate operational policies.
The 'Use when' line includes phrases like 'can we ship this' and 'are we ready to release', which are natural conversational questions that may appear in ordinary team discussion. The file does not provide exclusion conditions or tighter scope beyond the general release context, increasing the chance of accidental activation.
The CI integration section documents exit-code semantics as if they are implemented, but this skill file only contains guidance and sample commands, not actual logic enforcing those exits. Teams may wire this into release automation expecting hard failure semantics that never occur, weakening release gates.