Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local static-analysis helper for finding missing rate limits and related resource-exhaustion risks, with no evidence of hidden execution, data exfiltration, or persistence.
Installers should understand that the tool reads source files under the path they choose and may produce false positives because it uses regex proximity checks. Treat findings as review prompts, especially for centralized middleware or abstracted frameworks, rather than automatic proof of vulnerability.
The manifest description centers the skill on detecting missing rate limits on API endpoints. However, the implemented checks RL007, RL008, and RL009 analyze retry strategies, background queue/semaphore usage, and circuit-breaker or timeout protections, which go beyond rate-limiting semantics into general reliability and resource-management auditing.
The prose states the check finds email/SMS provider calls without a nearby guard and the sample output claims detection in a service file via caller-chain reasoning. In code, check_rl003_email_sms_no_limit does not traverse callers at all; it simply skips cases unless a local route-handler regex is present in nearby lines, which is a materially different behavior.
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
severity="HIGH",
location="<project>",
message="No rate-limiting library imported anywhere in the codebase. All endpoints are unprotected.",
attack="Unlimited requests — brute force, DoS, cost amplification attacks all possible.",
cwe="CWE-400: Uncontrolled Resource Consumption",
fix=(
"JS: npm install express-rate-limit | "
The Quick Start and CLI help both describe verbose output, and audit() even accepts a verbose argument. But no code path changes output based on verbose, so the documentation promises behavior that the implementation does not provide.