Receber por email
← Voltar para o catálogo

start-audit

Guided first-run security audit: doctor, scope, threats, scan, verify, report.

22estrelas
Atualizado há 4 meses

Ver no GitHub ↗ Licença: MIT

Como adicionar

/plugin marketplace add allsmog/vuln-scout

O comando exato pode variar conforme o repositório. Confira o README no GitHub.

Para o autor da skill

Cole no README do seu repo

Mostra que sua skill está catalogada na Skillteca, gera backlink e tráfego rastreável.

[![Skillteca](https://www.skillteca.com.br/api/badge/start-audit/svg)](https://www.skillteca.com.br/skills/start-audit)

Skills relacionadas

Ver todas de Segurança →

Alerta por categoria

Receba novas skills de Segurança toda segunda

1 email curto, só com as skills novas de Segurança. 4 minutos de leitura, sem spam, cancela com 1 clique.

Você confirma o email no primeiro envio. Sem spam. Cancela com 1 clique.

Ler descrição completa

Start Audit

Use this task skill when the user asks to start a security audit, audit this repo, perform a security review of a codebase, or review this codebase for vulnerabilities.

Workflow

  1. Run python3 vuln-scout/scripts/doctor.py --strict or ask the user to address missing quick-profile dependencies.
  2. Trigger session-init and large-codebase-check hooks when the target is a repo or monorepo.
  3. Run /vuln-scout:scope to establish boundaries and write .claude/audit-plan.md.
  4. Call app-mapper, then /vuln-scout:threats, then threat-modeler.
  5. Run /vuln-scout:scan --profile quick first; use deep only when optional analyzers are installed or requested.
  6. Call code-reviewer on prioritized findings.
  7. Run /vuln-scout:verify per finding that needs confirmation.
  8. Finish with /vuln-scout:report --format bundle --output evidence-bundle.

Produces

  • .claude/audit-plan.md
  • .claude/review-ledger.json
  • .claude/findings.json
  • report.html
  • evidence-bundle/

When NOT To Trigger

Do not trigger for knowledge-only questions about STRIDE, OWASP, dangerous functions, framework patterns, compliance mapping, exploit techniques, or vulnerability classes. Let those knowledge skills answer directly unless the user asks to audit a target.

Compartilhar X LinkedIn