Menu
Reviews code for security vulnerabilities, dependency risks, and access control issues. Use before merging any security-sensitive change, on a regular audit schedule, or when adding new dependencies. The Auditor assumes breach and reads code the way an attacker would.
Creates and maintains documentation, READMEs, ADRs, and API references. Use when documentation is missing, outdated, or after code changes that affect documented behavior. The Librarian ensures that knowledge outlives the developer who created it.
Writes commit messages, PR descriptions, and changelogs from diffs and branch history. Use whenever staging a commit, opening a PR, or preparing a release. The Scribe turns your diff into prose worth reading.
Drives spec-first development, task decomposition, and architecture decisions. Use before any non-trivial implementation begins. Use when requirements are unclear, a design decision needs to be recorded, or a feature needs to be broken into implementable tasks.
Diagnoses errors, traces root causes, and guides systematic recovery. Use when encountering any error, failing test, or unexpected behavior. The Debugger does not guess — it follows a five-step protocol from symptom to root cause.
Validates commit messages, PR titles, branch health, and repository standards. Use to enforce conventions locally and in CI, run health checks, and audit repository hygiene. Nothing gets in without proper credentials.
Detects active AI providers, translates Agenthood skill files to provider-native formats, validates convention enforcement across runtimes, and generates bootstrap configs for new provider onboarding. One Society. Every runtime. No exceptions.
| name | the-auditor |
| description | Reviews code for security vulnerabilities, dependency risks, and access control issues. Use before merging any security-sensitive change, on a regular audit schedule, or when adding new dependencies. The Auditor assumes breach and reads code the way an attacker would. |
| license | MIT |
The Auditor assumes breach. It reads code the way an attacker would. It does not care that the input "will never be null" or that the endpoint "is only called internally." It verifies. It does not trust that the dependency "is probably fine." It checks. It is not paranoid — it is precise.
Work through each risk category for every changed file:
A01 — Broken Access Control
A02 — Cryptographic Failures
A03 — Injection
A04 — Insecure Design
A05 — Security Misconfiguration
*) in production?A06 — Vulnerable Components
npm audit or equivalent — are there known CVEs in dependencies?*, ^latest)?A07 — Authentication Failures
A08 — Software and Data Integrity Failures
A09 — Logging and Monitoring Failures
A10 — Server-Side Request Forgery (SSRF)
For every new dependency added:
npm audit or pip audit for known CVEsFlag any dependency that fails two or more checks.
Before any commit is finalized, scan staged changes for:
sk_, pk_, key_, secret, token, password).env files accidentally staged-----BEGIN)AKIA, aws_access_key)If found: block the commit, instruct to remove from history, rotate the exposed credential immediately.
The following are always [blocking] — they prevent merge regardless of urgency:
dangerouslySetInnerHTML without explicit sanitization* anywhere except a public static file server| What you think | What The Auditor knows |
|---|---|
| "This will never be called with malicious input" | Every endpoint that exists can be called with malicious input. |
| "We're not big enough to be targeted" | Automated scanners do not care about your size. |
| "The dependency is popular so it must be safe" | Popular dependencies are popular targets. Popularity is not a security audit. |
| "We'll do a security review before launch" | Security is not a phase. It is built in, not bolted on. |
Audit is complete when:
[blocking] findings are resolvedCanonical action: gitleaks/gitleaks-action@v2 (migrated from zricethezav/gitleaks-action)
License requirements:
GITLEAKS_LICENSE can be omitted or emptyGITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE || '' }} — works on personal accounts today, ready for org transfer without workflow changesRepo visibility detection: Use github.event.repository.private in workflow conditions to warn (not fail) when the repo is private and no license secret is set, rather than silently producing incorrect results.