Run any Skill in Manus with one click

security-audit

Stars5

Forks0

UpdatedJune 3, 2026 at 09:23

Perform focused security reviews on code, diffs, hooks, and MCP servers. Look for auth issues, injection, secret leakage, unsafe tool/MCP usage, and hook risks. Use for any change involving external input, credentials, or agent capabilities. Triggers: "security review", "audit this diff", "check for vulnerabilities".

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

cobusgreyling

cobusgreyling/grok-build-arsenal

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

More from this repository

same repository

architecture-reviewer

cobusgreyling/grok-build-arsenal

Perform focused architecture and modularity reviews. Identify boundary violations, god objects, tangled dependencies, and propose the smallest reversible improvements. Use the repo-graph MCP when available. Trigger with "architecture review", "check the boundaries", "is this modular enough?".

2026-06-035

git-discipline

cobusgreyling/grok-build-arsenal

Enforce conventional commits, clean branch strategy, small focused diffs, and PR-ready history. Use before any commit or when preparing work for review. Triggers: "commit this cleanly", "prepare for PR", "fix the git history", "use git-discipline".

2026-06-035

mcp-orchestrator

cobusgreyling/grok-build-arsenal

Discover available MCP servers, evaluate their fit, install and configure them safely, and then use them effectively within sessions. Use when the user needs new capabilities (browser control, advanced git, observability, etc.) or when existing MCPs are under-utilized. Triggers: "set up MCPs", "install the right tools", "add an MCP for...", "what MCPs do we need?"

2026-06-035

plan-mode-orchestrator

cobusgreyling/grok-build-arsenal

For any non-trivial task, start in Plan Mode, produce a clear step-by-step plan with risks and verification method, and wait for explicit approval before any edits. Use when the user says "plan this", "use plan mode", "don't edit yet", or describes a complex feature/refactor/migration.

2026-06-035

subagent-arena

cobusgreyling/grok-build-arsenal

Run parallel independent subagents on the same investigation or design question, collect structured outputs, then synthesize the best elements or score approaches. Use for complex research, architecture decisions, or when multiple valid strategies exist. Trigger with "run an arena", "parallel subagents", "compare approaches", "investigate from multiple angles".

2026-06-035

tdd-intelligence

cobusgreyling/grok-build-arsenal

Apply rigorous test-first development. Write failing tests (or characterization tests) that capture desired behavior before implementing. Maintain high test coverage on changed code. Use for new features, refactors, and bug fixes where regression protection matters. Triggers: "TDD this", "test first", "write the test then implement", "add characterization tests".

2026-06-035

name	security-audit
description	Perform focused security reviews on code, diffs, hooks, and MCP servers. Look for auth issues, injection, secret leakage, unsafe tool/MCP usage, and hook risks. Use for any change involving external input, credentials, or agent capabilities. Triggers: "security review", "audit this diff", "check for vulnerabilities".
version	1.0.0
author	Cobus Greyling

Security Audit

Treat every hook, MCP, and agent capability as high-risk.

Checklist (always cover these)

Hard-coded secrets or credentials
Unsafe command execution or shell injection
Path traversal or arbitrary file access
Insufficient input validation / sanitization
Overly broad permissions in MCP servers or hooks
Trust model for project-provided hooks/skills
Data exfiltration risks (especially in research or browser MCPs)
Logging of sensitive information

Process

Identify the trust boundary for the change.
Trace data from untrusted sources (user input, files from disk, network, session logs).
Flag anything that can lead to code execution or secret access.
Propose the smallest hardening changes.
Recommend tests or verification steps (e.g. "try to escape the sandbox").

When Working on Meta-Tooling

Extra scrutiny for anything that will run inside other people's agent sessions (skills, MCPs, hooks in this arsenal itself).

Always pair with plan-mode-orchestrator for security-related work.