repo-first-defense

Audit AI-native repositories for dependency, workflow, prompt, and agent configuration risks.

46|14|Updated Jan 11, 2026

Search Tags:#security #audit #supply-chain #ci-cd #ai-native #hardening #repo

Ready to run

npx skills add https://github.com/alexdcd/Mafia-Claude-Skills --skill repo-first-defense

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: repo-first-defense
Source: https://github.com/alexdcd/Mafia-Claude-Skills/tree/main/skills/repo-first-defense
Command: npx skills add https://github.com/alexdcd/Mafia-Claude-Skills --skill repo-first-defense

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Este Skill protege repositorios AI-native al proveer una auditoría de seguridad completa, enfocada en dependencias, flujos de CI, prompts, y configuraciones de agentes para evitar vectores de ataque.

Core Features & Use Cases

Auditoría de seguridad de repositorio: analiza dependencias, flujos de CI, prompts y configuraciones de agentes para identificar vectores de ataque.
Generación de informe accionable: entrega hallazgos claros, evidencias y recomendaciones de hardening para equipos de desarrollo y seguridad.
Integración en pipelines: se puede adaptar a flujos de revisión de PR y despliegue con reglas reproducibles.

Quick Start

Ejecuta la auditoría de este repositorio para generar un informe de seguridad accionable antes de mergear o desplegar.

Frequently Asked Questions about repo-first-defense

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit security risks in an AI-native repository?▼

Auditing security in AI-native repositories involves analyzing dependencies, CI-CD workflows, prompts, and agent configurations to identify supply-chain risks and secrets exposure. It generates a structured risk report with actionable mitigations for production hardening.

What is supply-chain hardening for AI-native codebases?▼

Supply-chain hardening for AI-native codebases is the process of validating dependencies and ensuring reproducible installs to prevent malicious package injections. It involves auditing your repository configurations and workflows to mitigate external attack vectors before deployment.

How do I check for secrets exposure and misconfigurations before merging a PR?▼

Checking for secrets exposure and misconfigurations before merging a PR requires running a defensive audit on your repository workflows and agent settings. This pre-merge check identifies exposed credentials and invalid MCP configurations, providing evidence for remediation.

Can I integrate repository security audits into CI-CD pipelines?▼

Yes, you can integrate repository security audits into CI-CD pipelines by applying reproducible rules during PR reviews and deployment workflows. This automated defensive audit checks dependencies and prompts continuously to ensure production hardening standards are met.

How do I validate prompts and MCP configurations for security vulnerabilities?▼

Validating prompts and MCP configurations for security vulnerabilities requires auditing the agent settings within your AI-native repository. This defensive review identifies misconfigurations and potential prompt injection vectors, outputting structured findings for remediation.

What are the limitations of automated defensive audits for AI-native repositories?▼

Automated defensive audits for AI-native repositories are limited to identifying known patterns of misconfigurations, dependency risks, and secrets exposure. They require reproducible install environments to function accurately and may not detect novel zero-day supply-chain attacks.