cyber-audit

name	cyber-audit
description	Run read-only exposure checks for security advisories and write a structured local audit report.
category	security
risk	safe
source	community
source_repo	davidondrej/skills
source_type	community
date_added	2026-07-07
author	davidondrej
tags	["security","audit","read-only"]
tools	["claude","codex"]
license	MIT
license_source	https://github.com/davidondrej/skills/blob/main/LICENSE
disable-model-invocation	true

cyber-audit

When to Use

• Use when the user asks whether their machine or projects are affected by a CVE, breach, or package advisory.
• Use when a read-only local security exposure report is appropriate.

Hard rules

• Read-only. No installs, removes, upgrades, restarts, network calls, or file modifications outside ~/Documents/security-audits/.
• No sudo. Never.
• One report per invocation. Always end by writing the .md file (even if the verdict is "Not affected" — the audit trail matters).
• If a check requires a state-changing command, skip it and note "not checked (would require state change)" in the table. Do not run it.

Workflow

1. Identify scope. Extract from the advisory: package/binary name, affected versions, platform (macOS / Linux / Windows), attack vector (supply chain / RCE / local / network).
2. Run checks in parallel (Bash tool, multiple calls in one message). Pick relevant checks for the advisory type — don't run all of them.
3. Build the table as you go. Each row = one check + concrete result (version number, path, "None", "N/A").
4. Write the report to ~/Documents/security-audits/YYYY-MM-DD-<short-kebab-slug>.md. Use today's date from the environment header.
5. Tell the user the verdict in one line + path to the report.

Check menu (pick what's relevant)

# --- Node / npm ecosystem (supply-chain advisories) ---
which npm pnpm yarn; npm root -g; pnpm root -g 2>/dev/null
ls /opt/homebrew/lib/node_modules                                  # global npm
find ~ -maxdepth 8 -type d -name "<pkg>" 2>/dev/null \
  | grep -v -E "(Library/Caches|\.Trash)"                          # installed copies
find ~/Documents ~/Desktop ~/Downloads -maxdepth 8 -type f \
  \( -name "package.json" -o -name "package-lock.json" \
     -o -name "pnpm-lock.yaml" -o -name "yarn.lock" \) 2>/dev/null \
  | xargs grep -l  2>/dev/null                              


 python3 pip pipx uv
pip list 2>/dev/null | grep -i 
find ~/Documents -maxdepth 6 -name  -o -name  \
  -o -name  -o -name  2>/dev/null | xargs grep -l  2>/dev/null


brew list --versions <formula> 2>/dev/null
 <binary>; <binary> --version 2>/dev/null


pgrep -lf 
lsof -iTCP -sTCP:LISTEN -P -n 2>/dev/null | grep 


 ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons 2>/dev/null \
  | grep -i 


launchctl getenv <VAR>; grep -r  ~/.zshrc ~/.zprofile ~/.config 2>/dev/null


 ~/.vscode/extensions 2>/dev/null | grep -i