security-posture-audit

Read-only, offline audit of a repository's security hygiene posture: deterministic checks for unpinned dependencies (requirements/package.json/Dockerfile), committed .env/.pem/id_rsa files, hardcoded debug and wildcard-CORS flags, plain-http transports and pip trusted-host, risky GitHub Actions patterns (pull_request_target + head checkout, curl|sh), world-writable/setuid modes, and a missing SECURITY.md — every finding severity-graded with file:line evidence and a concrete remediation. Use when asked to "audit this repo's security posture", "run a security hygiene check", or "are our deps pinned / env files committed / workflows safe?" on a repo the user owns or is authorized to review. Not a CVE scanner (no advisory DB, no network), not SAST dataflow analysis, not a secrets-content scanner, and not norms verification — use base-in-reality for norms and agent-ready-rails for agent-readiness.

Ir a la instalación

Repositorio: dhanesh/agent-skills
Última actividad en el origen: 21 de julio de 2026 a las 20:27
Idioma detectado de SKILL.md: inglés
Estrellas: 1
Forks: 0

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/dhanesh/agent-skills --skill security-posture-audit

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

Explorador de archivos

6 archivos

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

feynman-walkthrough

Walk a person through a subject, codebase, whitepaper, or complex system until they genuinely understand it. Use whenever the user wants to understand or learn something: "explain X", "walk me through this repo/paper", "help me understand how Y works", "onboard me onto Z" — even if they never mention a learning method. Explains with Feynman-grade simplicity (plain language, analogy, concrete example before abstraction) and research-backed structure (big picture first, one segment at a time, checks matched to the goal), gauges understanding only AFTER the walkthrough to see where more coaching helps, and produces a standalone, sharable reference explainer — persisted as an Open Knowledge Format (OKF) bundle with source fingerprints pinned, so later sessions can review the knowledge and refresh it diff-aware when the codebase, document, or topic changes. A guided walkthrough, not a study regimen: retention tooling (spaced retrieval, self-quizzing, review schedules) exists but is strictly opt-in.

2026-07-28

crafting-self-prompting-loops

Design and build sound self-prompting loops — loops where a model iterates toward a goal across turns (draft→critique→revise, autonomous task loops, multi-agent orchestration, human-checkpointed loops). Use whenever the user wants to make a model "keep improving X until Y", build a self-refinement or reflexion loop, an autonomous agent that works toward a goal with little supervision, a loop that orchestrates or fans out to other agents, a recurring self-driven/scheduled task, or any agentic loop — even if they don't say the word "loop"; also use it to audit or fix an existing loop that runs away, never stops, oscillates, drifts off-goal, or is vulnerable to prompt injection. It produces a filled loop spec, a runnable scaffold, and bakes in the mandatory safety properties (a hard stop backstop and the trusted/untrusted two-channel boundary) that loops fail without.

2026-07-27

context-hygiene-kit

One-time SETUP that installs durable context management into a Claude Code project (or global ~/.claude): a bounded, scored, tiered cache that keeps working memory lean (anti-bloat) and rot-proof across compactions (anti-rot). Use when setting up, installing, configuring, verifying, or uninstalling context hygiene for a project or globally; when the user asks to "set up context management", "stop my context from bloating", "avoid context rot", "make Claude remember decisions across compaction", "persist working memory across sessions", or to replace a lossy local-model session-summariser with a deterministic lossless one. It drops in a stdlib-only Python ledger, a deterministic per-turn transcript harvester, and three lifecycle hooks (Stop / PreCompact / SessionStart) wired into settings.json — after install those hooks run automatically every turn, so you invoke this ONCE. Not an ongoing per-turn skill; not for ordinary app caching, RAG vector stores, or LLM prompt-caching config.

2026-07-27

Ver todos los de este repositorio

name	security-posture-audit
description	Read-only, offline audit of a repository's security hygiene posture: deterministic checks for unpinned dependencies (requirements/package.json/Dockerfile), committed .env/.pem/id_rsa files, hardcoded debug and wildcard-CORS flags, plain-http transports and pip trusted-host, risky GitHub Actions patterns (pull_request_target + head checkout, curl\|sh), world-writable/setuid modes, and a missing SECURITY.md — every finding severity-graded with file:line evidence and a concrete remediation. Use when asked to "audit this repo's security posture", "run a security hygiene check", or "are our deps pinned / env files committed / workflows safe?" on a repo the user owns or is authorized to review. Not a CVE scanner (no advisory DB, no network), not SAST dataflow analysis, not a secrets-content scanner, and not norms verification — use base-in-reality for norms and agent-ready-rails for agent-readiness.
license	MIT
compatibility	Requires python3 (stdlib only) and a POSIX-like shell. Fully offline — no network, no pip; file-mode checks are POSIX-only.
metadata	{"author":"dhanesh","version":"1.0.0","tags":"security,audit,posture,hygiene,dependency-pinning,ci-security,defensive"}