Agent skill · security · sickn33
cyber-audit
Run read-only exposure checks for security advisories and write a structured local audit report.
Why this skill is useful
Adds a structured workflow for conducting security audits and generating reports that the AI wouldn't reliably generate on its own.
What it needs
About 3k tokens when loaded. Last updated 2026-08-07. 44,571 stars on the source repository.
What this skill does
cyber-audit When to Use Use when the user asks whether their machine or projects are affected by a CVE, breach, or package advisory. Use when a read-only local security exposure report is appropriate. Hard rules Read-only. No installs, removes, upgrades, restarts, network calls, or file modifications outside ~/Documents/security-audits/. No sudo. Never. One report per invocation. Always end by writing the .md file (even if the verdict is "Not affected" — the audit trail matters). If a check requires a state-changing command, skip it and note "not checked (would require state change)" in the table. Do not run it. Workflow 1. Identify scope. Extract from the advisory: package/binary name, affected versions, platform (macOS / Linux / Windows), attack vector (supply chain / RCE / local / network). 2. Run checks in parallel (Bash tool, multiple calls in one message). Pick relevant checks for the advisory type — don't run all of them. 3. Build the table as you go. Each row = one check + concrete result (version number, path, "None", "N/A"). 4. Write the report to ~/Documents/security-audits/YYYY-MM-DD-<short-kebab-slug>.md. Use today's date from the environment header. 5. Tell the user the verdict in one line + path to the report. Check menu (pick what's relevant) If the advisory mentions an ecosystem not above (Rust cargo, Go modules, Ruby gems, Docker images, etc.), apply the same pattern: global install path + manifest grep + running processes. Report template File: ~/Documents/security-audits/YYYY-MM-DD-<short-kebab-slug>.md Match the tone of the two existing reports in ~/Documents/security-audits/ — terse, factual, bulleted, no hedging. Verdict wording Not affected. — package/binary absent, or installed but patched, or not running and not exposed. Affected. — vulnerable version present and reachable by the attack vector. Partially affected. — present but mitigated (e.g. binary installed but service not running, or listener bound to loopback only). …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills sickn33/cyber-audit--c51aa3