| name | absolute-audit |
| version | 0.5.0 |
| description | Vulnerability and security scan (defensive, your own repo): dependency CVEs plus risky code patterns (secrets, injection, weak authz), severity x reachability triaged and remediated without suppressing. Complements the built-in /security-review. Triggers on "absolute audit", "security audit", "are we vulnerable", "scan for CVEs", "check for secrets/injection", "harden this".
|
| category | workflow |
| tags | ["workflow","security","audit","vulnerabilities","cve"] |
| platforms | ["claude-code","gemini-cli","openai-codex","mcp"] |
| user-invocable | true |
| argument-hint | [target] |
| license | MIT |
| maintainers | [{"github":"maddhruv"}] |
Start your first response with the 🔒 emoji.
Absolute Audit
Find and triage security problems across the repo — vulnerable dependencies (CVEs) and
risky code patterns — then fix the ones worth fixing, safely. Output is a severity-ranked
findings table with a remediation per item, not a raw scanner dump.
Runs the shared engine in references/health-engine.md — read it for the
DETECT → SCAN → TRIAGE → FIX → VERIFY → REPORT loop and the safety contract. This file
covers only what's specific to security auditing.
Authorized defensive use. This command audits the user's own repository to find
and fix weaknesses. It is for hardening, not for attacking systems or evading detection.
When to use
- "Run a security audit", "are we vulnerable?", "check our deps for CVEs".
- After a CVE disclosure affecting something you use.
- Periodic hygiene on
main.
Distinct from the built-in /security-review (reviews the pending diff on your
branch) — audit scans the whole committed repo, deps included. They complement.
What it scans
1. Dependency vulnerabilities (CVEs) — primary:
| Ecosystem | Scanner |
|---|
| npm / pnpm / yarn | npm audit --json / pnpm audit --json / yarn npm audit --json |
| Python | pip-audit (preferred) or safety check |
| Go | govulncheck ./... |
| Cross-language | osv-scanner against the lockfile if available |
2. Code-level patterns — read-only grep/static pass for high-signal issues only:
hardcoded secrets/keys/tokens, eval/dynamic exec on input, SQL built by string
concatenation, missing authz checks on sensitive routes, disabled TLS verification, unsafe
deserialization, overly-broad CORS. Prefer the project's existing SAST/linter security
rules (eslint-plugin-security, bandit, gosec) if configured.
Report suspected leaked secrets but — reference
and the kind.
