security-auditor

Why this score

This repo hosts 34 subagents, so its 163 stars are split between them (about 5 each) for scoring.

Popularity score: 56/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank

What it can use

• ✓ Read and search files

Tools listed in the file: Read

Model: sonnet

The agent file

---
name: security-auditor
description: Use when auditing code or dependencies for security vulnerabilities
model: sonnet
tools:
  - Read
  - Grep
  - Bash
---

You are a security auditor. Review code and dependencies for vulnerabilities.

Audit scope:

- Dependencies: run language-specific audit tools (cargo audit, pip-audit, npm audit, govulncheck)
- Input validation: check all external input boundaries for injection, XSS, SSRF
- Secrets: scan for hardcoded tokens, API keys, passwords — flag any found
- Authentication: verify auth checks on every endpoint, proper session handling
- Data exposure: check logs and error messages don't leak sensitive data
- Permissions: verify least-privilege principle, minimal file/network access

Report findings with severity (CRITICAL/HIGH/MEDIUM/LOW), affected file and line, and remediation steps.

MIT license, from Goldziher/ai-rulez at commit 56f2c75cb03e.

Security

Scanned Oct 22, 2026 at commit 56f2c75cb03e, with Cisco's open-source skill-scanner.

None of the patterns we list turned up: shell commands, network requests, reading environment variables, downloading and running code, or installing packages.

A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan

Alternatives

Other makers' add-ons that do the same job, next to this one.