Run any Skill in Manus with one click

Get Started

security-audit

Stars9

Forks5

UpdatedJuly 10, 2026 at 06:50

Run a security-focused code audit with a generic checklist first, then layer on repo-specific risks.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

stella

stella/folio

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

name	security-audit
description	Run a security-focused code audit with a generic checklist first, then layer on repo-specific risks.

Security Audit

Run a security-focused code audit with a generic checklist first, then layer on repo-specific risks.

Instructions

Start with repo context:
- what kind of system is this?
- what data does it handle?
- what are the trust boundaries?
- what would be high-impact failures here?
Check for hardcoded secrets:
- API keys
- tokens
- passwords
- private connection strings
Review authentication and authorization:
- are protected routes actually protected?
- are object/resource ownership checks enforced server-side?
- are role checks done at the boundary, not just in the UI?
Review input handling:
- validation present for user-controlled inputs
- no obvious SQL injection, command injection, XSS, or path traversal
- file paths, URLs, and object keys are sanitized appropriately
Review file and storage access when relevant:
- upload validation
- download/presign access checks
- safe retention/deletion behavior
Review network and session behavior:
- sane session expiration and invalidation
- rate limits where brute force is plausible
- external requests have timeouts and failure handling
- CORS is not broader than necessary
Review dependency risk:
```
bun audit
```
Use the repo's equivalent audit command if it does not use Bun. Also check GitHub security or Dependabot alerts when available.
Review AI-specific risks when applicable:
- prompt injection exposure
- unsafe interpolation of user content into system instructions
- cross-tenant or cross-document leakage through retrieval/context assembly
Layer in domain-specific risks:
- finance, healthcare, legal, infra, auth, multi-tenant SaaS, and internal tools all have different sharp edges
- explicitly call out the domain assumptions you used
Report findings by severity:

Critical
High
Medium
Low

For each finding include:

file and line
issue
likely impact
recommended fix

If there are no findings, say so explicitly and mention what was checked plus any residual gaps in verification.

More from this repository

same repository

folio-agents

stella/folio

Integrate and use @stll/folio-agents, the framework-neutral LLM tool layer over @stll/folio-core: function-calling tools that read and mutate a .docx document, with every mutation landing as a tracked change or comment pending human review. Load this skill when wiring folio's tools into an agent's tool-use loop (TanStack AI, Vercel AI SDK, raw Anthropic/OpenAI SDKs, or a custom loop), choosing between the headless reviewer bridge and the live-editor-ref bridge, or summarizing what changed between two document versions.

2026-07-149

plan

stella/folio

Create a new implementation plan in the repo's planning area.

2026-07-109

product-think

stella/folio

Shape a feature or problem before implementation. Use this when the request is still fuzzy, when several solutions are possible, or when execution risks outrunning product clarity.

2026-07-109

rabbit-round

stella/folio

Process automated PR review comments systematically. Use this for CodeRabbit, Gemini, GitHub Copilot, Devin, Greptile, and similar bots.

2026-07-109

regression-hunt

stella/folio

Track down a behavior that used to work and now fails, changed, or regressed. Use this when a bug report points to a recent breakage, especially when the cause is not obvious yet.

2026-07-109

update-deps

stella/folio

Review and update third-party dependencies. Use this when asked to upgrade packages, survey new minor or major releases for useful features, assess whether a repository can adopt them, or validate whether a release looks suspicious before bumping it.

2026-07-109

Security Audit

Run a security-focused code audit with a generic checklist first, then layer on repo-specific risks.

Instructions

Start with repo context:

what kind of system is this?
what data does it handle?
what are the trust boundaries?
what would be high-impact failures here?

Check for hardcoded secrets:

API keys
tokens
passwords
private connection strings

Review authentication and authorization:

are protected routes actually protected?
are object/resource ownership checks enforced server-side?
are role checks done at the boundary, not just in the UI?

Review input handling:

validation present for user-controlled inputs
no obvious SQL injection, command injection, XSS, or path traversal
file paths, URLs, and object keys are sanitized appropriately

Review file and storage access when relevant:

upload validation
download/presign access checks
safe retention/deletion behavior

Review network and session behavior:

sane session expiration and invalidation
rate limits where brute force is plausible
external requests have timeouts and failure handling
CORS is not broader than necessary

Review dependency risk:

bun audit

Use the repo's equivalent audit command if it does not use Bun. Also check GitHub security or Dependabot alerts when available.

Review AI-specific risks when applicable:

prompt injection exposure
unsafe interpolation of user content into system instructions
cross-tenant or cross-document leakage through retrieval/context assembly

Layer in domain-specific risks:

finance, healthcare, legal, infra, auth, multi-tenant SaaS, and internal tools all have different sharp edges
explicitly call out the domain assumptions you used

Report findings by severity:

Critical

High

Medium

Low

For each finding include:

file and line

issue

likely impact

recommended fix

If there are no findings, say so explicitly and mention what was checked plus any residual gaps in verification.