skills.rest
vigolium
vigoliumOFFICIAL
Explore all skills by this author →
Website𝕏@VigoliumGitHub

audit

Identify and remediate security vulnerabilities in source code repositories.

108|9|Updated Apr 27, 2026
Search Tags:#security#audit#threat-modeling#static-analysis#codeql#semgrep
One-click install
npx skills add https://github.com/vigolium/piolium --skill audit-vigolium
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: audit
Source: https://github.com/vigolium/piolium/tree/main/skills/audit
Command: npx skills add https://github.com/vigolium/piolium --skill audit-vigolium

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill provides a repeatable, end-to-end security audit framework that helps teams identify, prioritize, and validate vulnerabilities in arbitrary source code repositories.

Core Features & Use Cases

  • 10-phase audit methodology orchestrated by advisory intelligence, knowledge base construction, static analysis, risk modeling, deep bug hunting, and final reporting.
  • Deterministic workflow with resumption that supports partial re-runs and incremental audits using persisted state.
  • Integrated tooling & artifacts: CodeQL structural analysis outputs, Semgrep Pro passes, and domain threat modeling guidance embedded in KB.
  • Operational guidance for large/complex repos: multi-component architectures, distributed systems, or non-standard stacks.
  • Final reporting: consolidated vulnerability findings with PoCs and executive-ready final audit report.

Quick Start

Trigger a full repository audit to start Phase 1 intelligence gathering and initiate the 10-phase lifecycle.

Frequently Asked Questions about audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a structured security audit on a complex codebase?▼

A structured security audit uses a 10-phase workflow covering intelligence gathering, threat modeling, static analysis, and deep bug hunting to identify and remediate vulnerabilities in complex source code repositories.

What is threat modeling and static analysis in a source code security audit?▼

Threat modeling and static analysis in a security audit involve constructing a knowledge base and using tools like CodeQL and Semgrep to structurally identify potential vulnerabilities before deep bug hunting.

Can I run a partial security audit and resume it later on large repositories?▼

Yes, the security audit workflow supports partial re-runs and incremental audits on large repositories by using persisted state for deterministic workflow resumption.

Does CodeQL and Semgrep work together for deep bug hunting?▼

CodeQL and Semgrep work together by providing structural analysis outputs and custom rule passes that feed directly into the deep bug hunting phase of the security audit lifecycle.

How do I generate an executive-ready report after a codebase security audit?▼

You generate an executive-ready report by consolidating vulnerability findings and proof of concepts from the 10-phase audit workflow into a formal final document suitable for stakeholder review.

Related Skills

Explore More Software Engineering Skills→
philo-grovesphilo-groves
12

maxtac-source-patch-history-loop

Correlate source commit history with CVEs, advisories, and hardening diffs.

Community
Advanced
terrazul-aiterrazul-ai

report-generator

Consolidates UX evaluation findings into standardized reports with Markdown and JSON outputs.

Official
Intermediate
hardw00thardw00t
90

sast-orchestration

Orchestrate Semgrep, CodeQL, and Bandit scans across codebases.

Community
Advanced
statick88statick88
1

vulnerability-scanning

Automate vulnerability detection across code, dependencies, containers, and infrastructure.

Community
Advanced