security-audit

security-audit is an Application security skill for AI agents, published by petrsvihlik in the WopiHost repository on GitHub. Skillspace rates security-audit F (45/100) and the safety scan rated it risky; the rating is based on static analysis only.

Risky. This skill has patterns associated with unsafe behaviour. Read the source carefully before running it.

Run a repeatable, threat-model-driven security audit of the WopiHost codebase and produce a tracker-ready findings report. Use this whenever the user wants a security-focused sweep — a WOPI threat-model review, "is this safe to ship", token/JWT and WOPI-proof validation, access-token scoping and authorization-bypass, path traversal in a storage provider, secret handling (keys, tokens, proof headers in logs), constant-time comparison, weak randomness, postMessage / origin validation, XXE in discovery-XML parsing, dependency CVEs, dev-only escape hatches, or info disclosure. Trigger on phrasings like "security audit", "security review", "threat model", "pen-test the host", "check for auth bypass / path traversal / secret leakage", "is the token handling safe", "harden the host", or "find security holes" — even when the user doesn't say the word "audit". This is the security counterpart to `codebase-audit` (which is the broad code-quality sweep); reach for this one when the lens is…

Grade

F

Quality

45 / 100

Safety

Risky

GitHub stars

218

Unproven: rated by static analysis only, not yet compared head-to-head.

This rating describes the version of the repository we crawled; it may have changed since.

Skillspace indexes and rates this skill; it does not host or endorse it. Run third-party skills at your own risk.