warden-audit

Identify and remediate security vulnerabilities across codebases and deployment stacks.

69|8|Updated Mar 16, 2026
One-click install
npx skills add https://github.com/tonone-ai/tonone --skill warden-audit
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: warden-audit
Source: https://github.com/tonone-ai/tonone/tree/main/team/warden/skills/warden-audit
Command: npx skills add https://github.com/tonone-ai/tonone --skill warden-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

A comprehensive security audit helps identify secrets, misconfigurations, and policy gaps before they become real-world risks.

Core Features & Use Cases

  • Secrets & Dependency Scan: Detects exposed credentials, tokens, and vulnerable dependencies.
  • IAM & Access Review: Evaluates permissions, roles, and access controls for least-privilege.
  • Web Security & API Hardening: Checks for injection, XSS, HTTPS enforcement, rate limiting, and public storage exposure.
  • Use Case: When preparing a security review for a new repo, run this audit to surface critical risks and recommended mitigations.

Quick Start

Run the audit against your project to surface critical risks and recommended mitigations.

Frequently Asked Questions about warden-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is included in a comprehensive codebase security audit?

A security audit checks for exposed credentials, vulnerable dependencies, IAM misconfigurations, injection flaws, XSS, and missing HTTPS enforcement. It evaluates permissions for least-privilege and identifies public storage exposure across your repos and cloud stack.

How do I scan for exposed secrets and vulnerable dependencies in my repo?

Run a security audit against your repository to detect exposed credentials, tokens, and vulnerable dependencies. The audit performs secret scanning and dependency CVE checks to surface critical risks and provide recommended mitigations before deployment.

Can I use this security audit for cloud IAM and access control reviews?

Yes, the security audit evaluates IAM permissions, roles, and access controls to ensure least-privilege configurations. It reviews cloud configurations alongside web apps and APIs to identify policy gaps and misconfigurations in your deployment stack.

Does this audit check for API rate limiting and HTTPS enforcement?

Yes, the audit checks for HTTPS enforcement and rate limiting as part of web security and API hardening. It also inspects injection protection, XSS vulnerabilities, and public storage exposure to provide a complete security posture review.

When should I run a security posture review on my deployment stack?

Run a security posture review during new project onboarding or after dependency updates. The audit performs an end-to-end checklist including secret scanning, IAM review, and auth correctness to identify misconfigurations and policy gaps before they become real-world risks.

What's the best way to harden web applications against injection and XSS attacks?

Run an end-to-end security audit to check for injection protection and XSS vulnerabilities. The audit evaluates auth correctness, HTTPS enforcement, and rate limiting across web apps and APIs, providing recommended mitigations for identified critical risks.