Security audit
Security checks for vulnerabilities and agentic risk
This is a code-review guidance skill with disclosed read-only review, subagent, and optional external-review behavior, not an installer or hidden execution package.
Install only if you are comfortable with a review skill reading relevant repository context. Do not use optional external CLI reviewers for private code unless you approve the specific packet and understand what will leave the machine.
Referenced artifact was not completely inspected
d merge-base range rather than a working-tree delta; read [scope-resolution.md](./references/scope-resolution.md) for stacked/shallow branches and coverage mech
Referenced artifact was not completely inspected
s/standard-review-process.md). Resolve each unit through [language-profiles.md](./references/language-profiles.md), loading one primary stack skill and at most
Referenced artifact was not completely inspected
[check-categories.md](./references/check-categories.md), [security-patterns.md](./references/security-patterns.md), or [reliability-patterns.md](./references/re
Referenced artifact was not completely inspected
equences. Extended examples and anti-patterns live in [review-traps-catalog.md](./references/review-traps-catalog.md); load the relevant topics when a claim dep
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Out of scope:
- Acting as the runtime instructions themselves (those live in `SKILL.md`).
- Trigger phrasings already covered by adjacent `ia-*` skills (`validate-plugin` flags >70% description overlap as DUPLICATE_TRIGGER).
- <!-- to fill in: domain-specific exclusions when the skill drifts -->
## Trigger Context
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- the `.env` family (`.env`, `.env.*`), except template variants
`.env.example`, `.env.sample`, and `.env.template`
- SSH private keys: `**/.ssh/**`, `id_rsa`, `id_dsa`, `id_ecdsa`, `id_ed25519`
- `.netrc`, `.npmrc`, `.pypirc`, `.dockercfg`
Decide on the path alone; never read the file's content to make the call.
Report each excluded path in the packet description so the operator knows it
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- the `.env` family (`.env`, `.env.*`), except template variants
`.env.example`, `.env.sample`, and `.env.template`
- SSH private keys: `**/.ssh/**`, `id_rsa`, `id_dsa`, `id_ecdsa`, `id_ed25519`
- `.netrc`, `.npmrc`, `.pypirc`, `.dockercfg`
Decide on the path alone; never read the file's content to make the call.
Report each excluded path in the packet description so the operator knows it
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- the `.env` family (`.env`, `.env.*`), except template variants
`.env.example`, `.env.sample`, and `.env.template`
- SSH private keys: `**/.ssh/**`, `id_rsa`, `id_dsa`, `id_ecdsa`, `id_ed25519`
- `.netrc`, `.npmrc`, `.pypirc`, `.dockercfg`
Decide on the path alone; never read the file's content to make the call.
Report each excluded path in the packet description so the operator knows it
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Hardcoded paths that should be variables
- Deploy credentials in unprotected or unmasked CI variables, or deploy jobs allowed on unprotected branches/tags. Protect and mask deploy variables, and restrict deployment to protected refs.
- A remote installer piped directly into a shell interpreter: flag only in jobs or image builds that hold secrets. Use the package manager or a pinned release with a verified checksum; apply the fail-open integrity check in [security-patterns.md](./security-patterns.md).
- TLS verification bypasses in CLI/CI: `curl -k`/`--insecure`, `wget --no-check-certificate`, `kubectl --insecure-skip-tls-verify`, `git -c http.sslVerify=false`/`GIT_SSL_NO_VERIFY`, `pip --trusted-host`, or `npm config set strict-ssl false`. Supply the intended CA instead, using the tool's CA option such as `--cacert` or `--certificate-authority`.
## GitHub Actions (.github/workflows/*.yml)
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Hardcoded paths that should be variables
- Deploy credentials in unprotected or unmasked CI variables, or deploy jobs allowed on unprotected branches/tags. Protect and mask deploy variables, and restrict deployment to protected refs.
- A remote installer piped directly into a shell interpreter: flag only in jobs or image builds that hold secrets. Use the package manager or a pinned release with a verified checksum; apply the fail-open integrity check in [security-patterns.md](./security-patterns.md).
- TLS verification bypasses in CLI/CI: `curl -k`/`--insecure`, `wget --no-check-certificate`, `kubectl --insecure-skip-tls-verify`, `git -c http.sslVerify=false`/`GIT_SSL_NO_VERIFY`, `pip --trusted-host`, or `npm config set strict-ssl false`. Supply the intended CA instead, using the tool's CA option such as `--cacert` or `--certificate-authority`.
## GitHub Actions (.github/workflows/*.yml)
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Hardcoded paths that should be variables
- Deploy credentials in unprotected or unmasked CI variables, or deploy jobs allowed on unprotected branches/tags. Protect and mask deploy variables, and restrict deployment to protected refs.
- A remote installer piped directly into a shell interpreter: flag only in jobs or image builds that hold secrets. Use the package manager or a pinned release with a verified checksum; apply the fail-open integrity check in [security-patterns.md](./security-patterns.md).
- TLS verification bypasses in CLI/CI: `curl -k`/`--insecure`, `wget --no-check-certificate`, `kubectl --insecure-skip-tls-verify`, `git -c http.sslVerify=false`/`GIT_SSL_NO_VERIFY`, `pip --trusted-host`, or `npm config set strict-ssl false`. Supply the intended CA instead, using the tool's CA option such as `--cacert` or `--certificate-authority`.
## GitHub Actions (.github/workflows/*.yml)
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Hardcoded paths that should be variables
- Deploy credentials in unprotected or unmasked CI variables, or deploy jobs allowed on unprotected branches/tags. Protect and mask deploy variables, and restrict deployment to protected refs.
- A remote installer piped directly into a shell interpreter: flag only in jobs or image builds that hold secrets. Use the package manager or a pinned release with a verified checksum; apply the fail-open integrity check in [security-patterns.md](./security-patterns.md).
- TLS verification bypasses in CLI/CI: `curl -k`/`--insecure`, `wget --no-check-certificate`, `kubectl --insecure-skip-tls-verify`, `git -c http.sslVerify=false`/`GIT_SSL_NO_VERIFY`, `pip --trusted-host`, or `npm config set strict-ssl false`. Supply the intended CA instead, using the tool's CA option such as `--cacert` or `--certificate-authority`.
## GitHub Actions (.github/workflows/*.yml)
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Hardcoded paths that should be variables
- Deploy credentials in unprotected or unmasked CI variables, or deploy jobs allowed on unprotected branches/tags. Protect and mask deploy variables, and restrict deployment to protected refs.
- A remote installer piped directly into a shell interpreter: flag only in jobs or image builds that hold secrets. Use the package manager or a pinned release with a verified checksum; apply the fail-open integrity check in [security-patterns.md](./security-patterns.md).
- TLS verification bypasses in CLI/CI: `curl -k`/`--insecure`, `wget --no-check-certificate`, `kubectl --insecure-skip-tls-verify`, `git -c http.sslVerify=false`/`GIT_SSL_NO_VERIFY`, `pip --trusted-host`, or `npm config set strict-ssl false`. Supply the intended CA instead, using the tool's CA option such as `--cacert` or `--certificate-authority`.
## GitHub Actions (.github/workflows/*.yml)
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Hardcoded paths that should be variables
- Deploy credentials in unprotected or unmasked CI variables, or deploy jobs allowed on unprotected branches/tags. Protect and mask deploy variables, and restrict deployment to protected refs.
- A remote installer piped directly into a shell interpreter: flag only in jobs or image builds that hold secrets. Use the package manager or a pinned release with a verified checksum; apply the fail-open integrity check in [security-patterns.md](./security-patterns.md).
- TLS verification bypasses in CLI/CI: `curl -k`/`--insecure`, `wget --no-check-certificate`, `kubectl --insecure-skip-tls-verify`, `git -c http.sslVerify=false`/`GIT_SSL_NO_VERIFY`, `pip --trusted-host`, or `npm config set strict-ssl false`. Supply the intended CA instead, using the tool's CA option such as `--cacert` or `--certificate-authority`.
## GitHub Actions (.github/workflows/*.yml)
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Hardcoded paths that should be variables
- Deploy credentials in unprotected or unmasked CI variables, or deploy jobs allowed on unprotected branches/tags. Protect and mask deploy variables, and restrict deployment to protected refs.
- A remote installer piped directly into a shell interpreter: flag only in jobs or image builds that hold secrets. Use the package manager or a pinned release with a verified checksum; apply the fail-open integrity check in [security-patterns.md](./security-patterns.md).
- TLS verification bypasses in CLI/CI: `curl -k`/`--insecure`, `wget --no-check-certificate`, `kubectl --insecure-skip-tls-verify`, `git -c http.sslVerify=false`/`GIT_SSL_NO_VERIFY`, `pip --trusted-host`, or `npm config set strict-ssl false`. Supply the intended CA instead, using the tool's CA option such as `--cacert` or `--certificate-authority`.
## GitHub Actions (.github/workflows/*.yml)
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Hardcoded paths that should be variables
- Deploy credentials in unprotected or unmasked CI variables, or deploy jobs allowed on unprotected branches/tags. Protect and mask deploy variables, and restrict deployment to protected refs.
- A remote installer piped directly into a shell interpreter: flag only in jobs or image builds that hold secrets. Use the package manager or a pinned release with a verified checksum; apply the fail-open integrity check in [security-patterns.md](./security-patterns.md).
- TLS verification bypasses in CLI/CI: `curl -k`/`--insecure`, `wget --no-check-certificate`, `kubectl --insecure-skip-tls-verify`, `git -c http.sslVerify=false`/`GIT_SSL_NO_VERIFY`, `pip --trusted-host`, or `npm config set strict-ssl false`. Supply the intended CA instead, using the tool's CA option such as `--cacert` or `--certificate-authority`.
## GitHub Actions (.github/workflows/*.yml)
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Treat every modified, staged, and untracked file in that output as the user's
work-in-progress, not as clutter to clear. Do **not**, as review setup, run any
of: `git switch` / `git checkout <branch>`, `git reset --hard`, `git clean`,
`git stash` / `git stash -u`, or `gh pr checkout`. Each silently relocates or
destroys uncommitted work.
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
review
A review is read-only on the working tree. Setting up a review must not mutate what the user has in progress. Before any other setup step, run:
git status --short --branch -uall
Treat every modified, staged, and untracked file in that output as the user's
work-in-progress, not as clutter to clear. Do not, as review setup, run any
of: git switch / git checkout <branch>, git reset --hard, git clean,
git stash / git stash -u, or gh pr checkout. Each silently relocates or
destroys uncommitted work.
Moving untracked work "out of the way" is the same interference, not a
safeguard: do not copy or move the user's WIP to /tmp, a backup dir, or any
location outside the checkout to "protect" it. Relocating someone's uncommitted
work is the same class of harm as stashing it: it leaves the tree in a state
the user did not create and cannot predict.
If the target diff genuinely requires a different branch or a clean tree, stop and ask before switching, st
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
| Search for | Vulnerable pattern | Fix |
|-----------|-------------------|-----|
| PHP `exec(`, `system(`, `shell_exec(`, `passthru(`, backticks, `popen(`, `proc_open(` with a string command; Python `os.system(`, `subprocess.*(..., shell=True)`; Node `child_process.exec(`/`execSync(`, `spawn(..., { shell: true })` | A request-derived value inside a shell command string: `;`, `&&`, `$(...)`, backticks, and newlines run attacker commands | Pass an argv array with no shell: `proc_open([...])` (PHP 7.4+), `subprocess.run([...])` without `shell=True`, `execFile`/`spawn` with an argument array. When a shell string is unavoidable, wrap each value in `escapeshellarg()`; `escapeshellcmd()` on a whole command still lets the attacker add arguments |
| An argv element or `escapeshellarg()`-quoted value taken from untrusted input (request, uploaded file, repository content, another user) and passed to `git`, `ssh`, `curl`, `tar`, `rsync`, `find`, or similar | Option injection: argv form and quoting stop shell parsing, not option parsing, so a value starting with `-` becomes a flag (`--upload-pack=`, `-oProxyCommand=`, `-K`/`-o`, `--checkpoint-action=`, `-e`, `-exec`) that runs a command or writes a file | Reject a leading `-`, and place `--` before the untrusted operand for tools that honor it; a `--` after an operand does not protect that operand. `find` is an exception: its `--` ends only the leading options (`-H`, `-L`, `-P`, `-D`, `-O`), so a later `-exec` is still an expression; reject a leading `-`, prefix relative paths with `./`, and never build the expression from input. For git revision operands, see the next row |
| `git log "$ref"`, `git log "$ref" --`, `git checkout "$branch"`, `git clone "$url"` with an input-derived ref or URL | In git, a ref placed before `--` is read as an option when it starts with `-` (`--output=` writes a file); `--` does stop option parsing, but it turns every later argument into a pathspec, so `git log -- "$ref"` is not injectable yet cann
...[truncated 25 chars]
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
| `Math.random(`, `random.random(`, `mt_rand(` for tokens/secrets/IDs | Predictable value used as a security control | `crypto.randomBytes`, `secrets.token_urlsafe`, `random_bytes` |
| `verify=False`, `rejectUnauthorized: false`, `NODE_TLS_REJECT_UNAUTHORIZED=0`; `curl -k`/`--insecure`, `wget --no-check-certificate`, `kubectl --insecure-skip-tls-verify`, `http.sslVerify=false`/`GIT_SSL_NO_VERIFY`, `pip --trusted-host`, `npm config set strict-ssl false` | TLS certificate validation disabled in application, CLI, or CI traffic (MITM) | Remove the bypass; configure the correct CA (`--cacert`, `--certificate-authority`, or the client's trust store) |
| ECB mode, static/reused IV or nonce, home-rolled crypto, MD5/SHA1 for integrity | Deterministic ciphertext, reused nonce, forgeable integrity checks | AES-GCM/ChaCha20-Poly1305 with a fresh nonce, audited libraries, HMAC-SHA256+ |
| `sha256`/`hash_file(`/`hashlib`/signature or HMAC verify on a downloaded, cached, or uploaded artifact (installers, self-updaters, plugin or dependency fetchers) | Integrity check fails open: a missing or malformed digest counts as a pass, a mismatch is only logged or its return value is ignored, a mismatch falls back to a mirror or backend that skips verification, or a cache hit is used without re-verifying | A missing digest is a failure; route every acquisition path, cache reads included, through one verify-then-use helper that refuses the artifact on mismatch. Authenticate the expected digest through trusted provenance, a verified signed manifest, or an authenticated channel; an attacker who can replace both artifact and digest defeats comparison alone. A valid digest proves byte identity only, so archive-extraction checks (File Handling) still apply |
## Version-Gated False Positives
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
## Performance
- N+1 queries (loop with query per item; use batch/join instead)
- Unbounded collections (arrays/maps without size limits)
- Missing indexes on queried columns
## Adversarial (red-team pass)
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
## Performance
- N+1 queries (loop with query per item; use batch/join instead)
- Unbounded collections (arrays/maps without size limits)
- Missing indexes on queried columns
## Adversarial (red-team pass)
Line L011 states the main skill's rule is to 'pass the diff to agents; do NOT read it first,' framing parent non-reading as the default intent. But later sections require the orchestrator to pass full diff content into prompts, dispatch red-team and Skeptic agents over the diff, and apply merge logic based on findings derived from that diff, which makes the claimed non-reading rule internally inconsistent.
The deep-review instructions explicitly expand the skill's data access from an inline diff to broader repository reads, including standards files and full current bodies of selected files. In a review harness that is expected to keep scope tightly bounded to user-provided diffs, this can cause unintended data exposure and over-collection of repository content beyond what the user requested.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Pin the lookup to the project's actual version. Read `package.json`, `composer.json`, `requirements.txt`, `go.mod`, or `Cargo.toml` to identify the major version, then constrain queries (e.g. "Laravel 11 HasOneOrMany limit eager-load behavior").
If Context7 is unavailable, fall back to the vendor's official docs URL directly via the harness's web fetch tool. **Do not skip verification**: a finding that asserts framework behavior without a citation is worse than no finding, because authors trust review output.
When verified behavior contradicts the finding's premise, drop the finding. Report the version-correct evidence as a proposed lesson when useful. Edit the relevant entry in [review-traps-catalog.md](./review-traps-catalog.md) only under separate skill-maintenance authority; review alone does not authorize that write.
Detected: suspicious.exposed_secret_literal