kit

Consolidate security audit findings into a deduplicated known-issues.json register.

18|1|Updated Apr 21, 2026
One-click install
npx skills add https://github.com/J4X-Security/K.I.T --skill kit-j4x-security
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: kit
Source: https://github.com/J4X-Security/K.I.T/tree/main/claude-skill-kit
Command: npx skills add https://github.com/J4X-Security/K.I.T --skill kit-j4x-security

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pdfplumber, pypdf, and includes scripts (resource) components.

What problem does it solve?

KIT solves the problem of repeatedly re-reviewing security audit findings by consolidating prior reports into one canonical known-issues register and then checking whether new findings are already covered.

Core Features & Use Cases

  • Build a canonical known-issues.json by ingesting audit files, directories, PDFs, JSON, and web/GitHub sources, normalizing the content, and (via the staged workflow) deduplicating extracted issues.
  • Check a new issue or report against known-issues.json by running a staged extraction step and then applying a duplicate-check decision contract per finding.
  • Support messy real-world inputs by expanding GitHub repo/folder URLs, downloading remote artifacts, and extracting PDF text before issue extraction.

Quick Start

Ask the AI to build or extend known-issues.json from your audit inputs and then check a new finding against it using the staged workflow.

Frequently Asked Questions about kit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I consolidate duplicate security audit findings into a single register?

To consolidate duplicate security audit findings, you build a canonical known-issues.json register by ingesting local files, PDFs, URLs, and GitHub repositories. The Skill normalizes extracted content and applies model-driven deduplication to eliminate repeated issues across prior reports.

Can I extract audit findings directly from PDF reports and GitHub repositories?

Yes, you can extract audit findings from PDFs and GitHub repositories. The Skill expands GitHub repo or folder URLs, downloads remote artifacts, and uses pdfplumber and pypdf to extract PDF text before running the staged issue extraction workflow.

What is the best way to check if a new security finding is already covered by existing reports?

The best way to check if a new security finding is already covered is to run a staged extraction step followed by a duplicate-check decision contract. The Skill evaluates the new finding against the full known-issues.json list and returns a verdict on whether it is a duplicate.

Do I need specific workflow contracts to run the security audit deduplication process?

Yes, running the security audit deduplication process requires the presence of staged contracts like prepare-build, finalize-build, or prepare-check. These contracts enforce the LLM-authored canonical issue extraction, deduplication, and duplicate-check verdicts against your known-issues list.

How does model-driven deduplication handle messy real-world audit inputs?

Model-driven deduplication handles messy real-world audit inputs by normalizing extracted content from diverse sources like local directories, JSON, and web URLs. The LLM-authored workflow then applies canonical issue grouping to deduplicate extracted issues accurately.