What problem does it solve? AI coding agents introduce attack surfaces beyond traditional application security, such as malicious memory files, unsafe tool calls, and credential leakage. This Skill provides a structured checklist to audit code changes against these agent-specific threats before they ship. ## Core Features & Use Cases - Agent-Specific Threat Coverage: Detects prompt injection via MEMORY.md/USER.md, path traversal through tool calls, command injection via shell tools, and data exfiltration through fetch_url. - Audit Checklist: Verifies whether changes bypass trust/permission systems, skip memory safety scans, expose API keys in logs, or fetch external URLs without sandbox policy checks. - Aixlarity Source Mapping: Points reviewers to key security boundaries including trust.rs, agent/permissions.rs, tools/memory_tool.rs, and tools/container.rs. - Use Case: Before merging a pull request that adds a new tool to an AI agent, run this audit to confirm the tool respects the three-level trust model and does not create a new path for untrusted input to reach shell commands. ## Quick Start Use the security-audit skill to review my latest code changes for prompt injection, path traversal, and permission bypass vulnerabilities.
