skills.rest
stumman
stummanCOMMUNITY
Explore all skills by this author →
GitHub

ponytail-audit

Audit source code for dead code, hardcoded secrets, resource leaks, race conditions, and security vulnerabilities.

Updated Jun 15, 2026
Search Tags:#code review#security#code audit#dead code#security vulnerabilities
One-click install
npx skills add https://github.com/stumman/hermes-harness-skills --skill ponytail-audit-stumman
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ponytail-audit
Source: https://github.com/stumman/hermes-harness-skills/tree/main/.agents/skills/ponytail-audit
Command: npx skills add https://github.com/stumman/hermes-harness-skills --skill ponytail-audit-stumman

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pypdf, pdfplumber, pdf2image, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill performs a thorough code audit to identify and flag dead code, hardcoded secrets, resource leaks, race conditions, missing authentication, and security anti-patterns.

Core Features & Use Cases

  • Dead Code Identification: Detects unreachable branches, uncalled functions, unused imports, and hollow-shell functions.
  • Hardcoded Secrets Detection: Identifies API keys, tokens, passwords, and JWT secrets with literal fallback values.
  • Resource Leak Detection: Finds memory leaks, file handle leaks, and other resource management issues.
  • Race Condition Identification: Detects check-then-act asynchronous gaps, boolean flags used as locks, and shared mutable state.
  • Authentication and Validation Checks: Ensures input validation, authentication, and rate limiting are properly implemented.
  • Security Anti-Patterns Detection: Identifies non-constant-time secret comparison, template injection, logging secrets, and other security issues.
  • Use Case: When reviewing code for security vulnerabilities, auditing codebases for quality and security, or identifying potential performance bottlenecks.

Quick Start

Run the ponytail-audit skill on your codebase to detect and report security vulnerabilities and other issues.

Frequently Asked Questions about ponytail-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan source code for hardcoded secrets and security vulnerabilities?▼

To scan source code for hardcoded secrets and security vulnerabilities, run an automated code audit. This process analyzes your codebase to detect API keys, tokens, passwords, and security anti-patterns.

How do I detect dead code and unused imports in my codebase?▼

Detecting dead code and unused imports requires analyzing source code to find unreachable branches, uncalled functions, and hollow-shell functions. A dedicated code audit identifies these patterns to report dead code.

What is the best way to find race conditions and shared mutable state in asynchronous code?▼

Finding race conditions and shared mutable state involves checking for check-then-act asynchronous gaps and boolean flags used as locks. A code audit identifies these patterns to report potential race conditions.

Can a code audit detect resource leaks and memory leaks automatically?▼

Yes, a code audit can detect resource leaks and memory leaks automatically. It analyzes source code to find file handle leaks and other resource management issues, generating a report of the findings.

Does code audit work for identifying missing authentication and input validation?▼

Yes, code audit works for identifying missing authentication and input validation. It analyzes source code to ensure input validation, authentication, and rate limiting are properly implemented within the codebase.

Related Skills

Explore More Software Engineering Skills→
artgaurav16420-ossartgaurav16420-oss

pdf

Extract text and tables from PDFs using Python libraries.

Community
Advanced
goffitygoffity

security-auditor

Audit JavaScript, TypeScript, Python, and Go code for OWASP Top 10 risks and hardcoded secrets.

Community
Intermediate
eliottbusinesseliottbusiness

requesting-code-review

Automate pre-commit code review with static analysis and security scanning.

Community
Advanced
matteocervellimatteocervelli
25

security-scanner

Scan codebases for secrets, vulnerable dependencies, and insecure patterns.

Community
Advanced