Agent skill · security · sickn33
cyber-audit
Run read-only exposure checks for security advisories and write a structured local audit report.
Why this skill is useful
Adds specific commands and structured reporting for security audits that the AI wouldn't reliably generate on its own.
What it needs
About 3k tokens when loaded. Last updated 2026-08-07. 44,571 stars on the source repository.
What this skill does
cyber-audit When to Use Use when the user asks whether their machine or projects are affected by a CVE, breach, or package advisory. Use when a read-only local security exposure report is appropriate. Hard rules Read-only. No installs, removes, upgrades, restarts, network calls, or file modifications outside ~/Documents/security-audits/. No sudo. Never. One report per invocation. Always end by writing the .md file (even if the verdict is "Not affected" — the audit trail matters). If a check requires a state-changing command, skip it and note "not checked (would require state change)" in the table. Do not run it. Workflow 1. Identify scope. Extract from the advisory: package/binary name, affected versions, platform (macOS / Linux / Windows), attack vector (supply chain / RCE / local / network). 2. Run checks in parallel (Bash tool, multiple calls in one message). Pick relevant checks for the advisory type — don't run all of them. 3. Build the table as you go. Each row = one check + concrete result (version number, path, "None", "N/A"). 4. Write the report to ~/Documents/security-audits/YYYY-MM-DD-<short-kebab-slug>.md. Use today's date from the environment header. 5. Tell the user the verdict in one line + path to the report. Check menu (pick what's relevant) If the advisory mentions an ecosystem not above (Rust cargo, Go modules, Ruby gems, Docker images, etc.), apply the same pattern: global install path + manifest grep + running processes. Report template File: ~/Documents/security-audits/YYYY-MM-DD-<short-kebab-slug>.md Match the tone of the two existing reports in ~/Documents/security-audits/ — terse, factual, bulleted, no hedging. Verdict wording Not affected. — package/binary absent, or installed but patched, or not running and not exposed. Affected. — vulnerable version present and reachable by the attack vector. Partially affected. — present but mitigated (e.g. binary installed but service not running, or listener bound to loopback only). …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills sickn33/cyber-audit