What problem does it solve? Manually auditing an application repository for security flaws is slow and easy to get wrong, especially for AI-integrated apps where prompt injection, credential-injecting proxies, and trust-boundary drift create non-obvious exploit paths. This Skill performs a structured source-level security review and produces an operator-facing report with severity, file/line evidence, exploit paths, and fixes. ## Core Features & Use Cases - Trust-boundary-first review: Traces untrusted input into LLM prompts, filesystem/terminal tools, code execution, and document mutations, with dedicated checklists for Electron apps, Office add-ins, local AI agents, and self-hosted agent control planes. - Specialized audit patterns: Detects type drift across trust boundaries, inconsistent URL validation, prototype-pollution-sensitive dictionary lookups, stale-dist test imports, and dev-only vs runtime npm advisory disposition. - Privacy and release verdicts: Scans source and git metadata for PII, secrets, and machine identifiers, then issues separate privacy/secrets and public-release readiness verdicts. - Use Case: Point it at an Electron app that proxies to a local AI agent before shipping; it flags wildcard CORS on the credential-injecting loopback proxy, weak schema validation on model-generated actions, and unpinned dependency advisories, each with path:line evidence and a practical fix. ## Quick Start Ask the agent to review this repository for security issues and produce a severity-ranked report with file and line evidence.
