Security Audit

Identify and remediate security vulnerabilities in DevFlow hooks and scripts.

1|Updated Mar 27, 2026

Search Tags:#security #audit #hooks #vulnerabilities #scripts #risk-assessment #code-review

Ready to run

npx skills add https://github.com/NEXUZ-SYS/devflow --skill security-audit-nexuz-sys

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: Security Audit
Source: https://github.com/NEXUZ-SYS/devflow/tree/main/.context/skills/security-audit
Command: npx skills add https://github.com/NEXUZ-SYS/devflow --skill security-audit-nexuz-sys

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Identify and remediate security vulnerabilities in DevFlow hooks and utility scripts to prevent command injection, path traversal, and data exposure.

Core Features & Use Cases

Vulnerability checks: scan bash scripts for unquoted variables, eval, and unsafe exec patterns.
Path traversal safeguards: validate and sanitize user-controlled paths to prevent directory traversal.
MCP config review: ensure server registrations are pinned and safe.
Safe logging: verify scripts do not leak tokens or sensitive data in logs or outputs.

Quick Start

Run the security audit against all bash scripts in the hooks and scripts directories to surface critical issues.

Frequently Asked Questions about Security Audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I find command injection vulnerabilities in bash scripts?▼

To find command injection vulnerabilities in bash scripts, scan for unquoted variables, unsafe eval, and exec patterns. This security audit checks hook and utility scripts to surface and remediate these risks before deployment.

What does a path traversal safeguard check in DevFlow hooks?▼

A path traversal safeguard validates and sanitizes user-controlled paths to prevent unauthorized directory access. The audit reviews script inputs across Review and Validation phases to ensure no traversal exploits remain.

How do I prevent data leakage in script logging?▼

To prevent data leakage in script logging, verify that scripts do not output tokens or sensitive data. The audit enforces safe logging practices across all repository scripts to secure execution outputs.

Can I use this security audit to review MCP configurations?▼

Yes, you can use this security audit to review MCP configurations. It explicitly validates server registrations to ensure they are pinned and safe against potential injection or manipulation attacks.

When do I need to run a security audit on repository scripts?▼

You need to run a security audit on repository scripts during the Review and Validation phases of your workflow. This ensures bash variable quoting and explicit validation are enforced before integration.