Run any Skill in Manus with one click

security-audit

Stars1

Forks5

UpdatedJune 18, 2026 at 04:27

Use when user explicitly requests "security review", "audit security", "check for vulnerabilities", or "OWASP check", or when code-review identifies auth/payment/PII code needing a security pass. NOT automatic — must be explicitly requested or offered by code-review. Applies to Java/Quarkus, TypeScript, and Python projects.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

mdproctor

mdproctor/cc-praxis

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

File Explorer

5 files

SKILL.md

readonly

More from this repository

same repository

code-review

mdproctor/cc-praxis

Use when the user says "review the code", "check these changes", "review this", "look at staged changes", or invokes /code-review. Also invoked automatically by git-commit skills if no review has been done this session. Applies to Java/Quarkus, TypeScript, and Python projects.

2026-06-181

dependency-update

mdproctor/cc-praxis

Use when the user says "bump a version", "upgrade dependencies", "check for newer versions", "add a dependency", or "run audit" — for Java/Maven, TypeScript/npm, or Python/pip projects. Routes to the correct package manager based on project type declared in CLAUDE.md.

2026-06-181

git-commit

mdproctor/cc-praxis

Use when user wants to create a commit NOW — says "commit this", "commit these changes", "create a commit". Routes to Java or custom project workflows when CLAUDE.md declares those types; falls back to generic commit for all others. Does NOT apply to discussions about past commits or questions about whether to commit.

2026-06-181

git-squash

mdproctor/cc-praxis

Use when the commit history contains noise — fixup commits, revert chains, docs wording chores, tiny cleanups — that obscures meaningful history. Also triggered when the pre-push hook flags squash candidates, or invoked on demand via /git-squash on any commit range.

2026-06-181

handover

mdproctor/cc-praxis

Use when ending a mid-work session (branch stays open) and wanting to preserve context for resumption, OR when a session is beginning and needing to resume from where things left off — says "create a handover", "end of session", "update the handover", "write a handover", "wrap", or "resume handover". NOT for branch closure (use work-end — it includes the full wrap). NOT for project narrative (use write-content, diary type).

2026-06-181

issue-workflow

mdproctor/cc-praxis

Use when setting up GitHub issue tracking, planning implementation work (creating epics and child issues from a plan), when a user request spans multiple concerns that should be separate issues, or when staged changes span multiple issues and should be split. Also invoked automatically throughout the development lifecycle when Work Tracking is enabled in CLAUDE.md.

2026-06-181

name	security-audit
description	Use when user explicitly requests "security review", "audit security", "check for vulnerabilities", or "OWASP check", or when code-review identifies auth/payment/PII code needing a security pass. NOT automatic — must be explicitly requested or offered by code-review. Applies to Java/Quarkus, TypeScript, and Python projects.

Security Audit

Reads project type, then loads the language-specific audit checklist.

Step 0 — Load universal principles

Load ~/.hortora/garden/approaches/security-audit.md before proceeding.

Step 1 — Detect project type

python3 ~/.claude/skills/project-init/ctx.py

Read PROJECT_TYPE from the output.

Extract: java | ts | python

Step 2 — Load language-specific checklist

Project type	File to read
`java`	`~/.claude/skills/security-audit/java.md`
`ts`	`~/.claude/skills/security-audit/typescript.md`
`python`	`~/.claude/skills/security-audit/python.md`

Read the file, then execute the audit workflow it describes.

Skill Chaining

Invoked by: [code-review] when auth/payment/PII code is identified; user explicit request

Does NOT invoke: other skills automatically — findings are reported only