{"slug":"cyber-audit","title":"cyber-audit","summary":"Run read-only exposure checks for security advisories and write a structured local audit report.","platform":"ChatGPT","tags":["security"],"authorName":"LLM Mart","authorSlug":"llm-mart","score":0,"source":"github","price":null,"verified":false,"createdAt":"2026-08-16T13:38:24.136304Z","repo":{"url":"https://github.com/sickn33/agentic-awesome-skills","stars":46883,"forks":6831,"license":"MIT","updatedAt":"2026-09-25T05:43:16Z"},"bodyHtml":"
\n

name: cyber-audit\ndescription: \"Run read-only exposure checks for security advisories and write a structured local audit report.\"\ncategory: security\nrisk: safe\nsource: community\nsource_repo: davidondrej/skills\nsource_type: community\ndate_added: \"2026-07-07\"\nauthor: davidondrej\ntags: [security, audit, read-only]\ntools: [claude, codex]\nlicense: \"MIT\"\nlicense_source: \"https://github.com/davidondrej/skills/blob/main/LICENSE\"\ndisable-model-invocation: true

\n

cyber-audit

\n

When to Use

\n\n

Hard rules

\n\n

Workflow

\n
    \n
  1. Identify scope. Extract from the advisory: package/binary name, affected versions, platform (macOS / Linux / Windows), attack vector (supply chain / RCE / local / network).
    2. \n
  2. Run checks in parallel (Bash tool, multiple calls in one message). Pick relevant checks for the advisory type — don't run all of them.
    3. \n
  3. Build the table as you go. Each row = one check + concrete result (version number, path, \"None\", \"N/A\").
    4. \n
  4. Write the report to ~/Documents/security-audits/YYYY-MM-DD-<short-kebab-slug>.md. Use today's date from the environment header.
    5. \n
  5. Tell the user the verdict in one line + path to the report.
    6. \n
\n

Check menu (pick what's relevant)

\n
# --- Node / npm ecosystem (supply-chain advisories) ---\nwhich npm pnpm yarn; npm root -g; pnpm root -g 2>/dev/null\nls /opt/homebrew/lib/node_modules                                  # global npm\nfind ~ -maxdepth 8 -type d -name \"<pkg>\" 2>/dev/null \\\n  | grep -v -E \"(Library/Caches|\\.Trash)\"                          # installed copies\nfind ~/Documents ~/Desktop ~/Downloads -maxdepth 8 -type f \\\n  \\( -name \"package.json\" -o -name \"package-lock.json\" \\\n     -o -name \"pnpm-lock.yaml\" -o -name \"yarn.lock\" \\) 2>/dev/null \\\n  | xargs grep -l \"<pkg>\" 2>/dev/null                              # direct + transitive\n\n# --- Python ecosystem ---\nwhich python3 pip pipx uv\npip list 2>/dev/null | grep -i \"<pkg>\"\nfind ~/Documents -maxdepth 6 -name \"requirements*.txt\" -o -name \"pyproject.toml\" \\\n  -o -name \"poetry.lock\" -o -name \"uv.lock\" 2>/dev/null | xargs grep -l \"<pkg>\" 2>/dev/null\n\n# --- Homebrew / system binaries ---\nbrew list --versions <formula> 2>/dev/null\nwhich <binary>; <binary> --version 2>/dev/null\n\n# --- Running processes / listeners (for RCE / network CVEs) ---\npgrep -lf \"<binary>\"\nlsof -iTCP -sTCP:LISTEN -P -n 2>/dev/null | grep \"<port>\"\n\n# --- LaunchAgents / LaunchDaemons (persistence / autostart) ---\nls ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons 2>/dev/null \\\n  | grep -i \"<vendor>\"\n\n# --- Env vars that change exposure (e.g. OLLAMA_HOST, listening addr) ---\nlaunchctl getenv <VAR>; grep -r \"<VAR>\" ~/.zshrc ~/.zprofile ~/.config 2>/dev/null\n\n# --- VS Code / browser extensions (for IDE-targeted advisories) ---\nls ~/.vscode/extensions 2>/dev/null | grep -i \"<ext>\"\n
\n

If the advisory mentions an ecosystem not above (Rust cargo, Go modules, Ruby gems, Docker images, etc.), apply the same pattern: global install path + manifest grep + running processes.

\n

Report template

\n

File: ~/Documents/security-audits/YYYY-MM-DD-<short-kebab-slug>.md

\n
# <Subject> — Audit\n\n**Date:** YYYY-MM-DD\n**Host:** the user's Mac\n\n## <CVEs | Advisory> in scope\n\n- **<ID or source> \"<Name>\"** — <one-line description>. <Affected versions or scope>.\n\n## Audit results\n\n| Check | Result |\n|---|---|\n| <Check 1> | <Result> |\n| <Check 2> | <Result> |\n\n## Verdict\n\n**<Not affected. | Affected. | Partially affected.>**\n\n- <Rationale bullet 1>\n- <Rationale bullet 2>\n\n## Action taken\n\nNone — diagnostic only, no files modified, no <packages installed/removed | services started/stopped | firewall rules changed>.\n\n## Follow-ups\n\n- <Actionable item, or \"None\" if truly nothing>\n
\n

Match the tone of the two existing reports in ~/Documents/security-audits/ — terse, factual, bulleted, no hedging.

\n

Verdict wording

\n\n

When to break the read-only rule

\n

Never on your own. If the verdict is \"Affected\", list the remediation command in Follow-ups and stop. The user runs it.

\n

Reference

\n

Two existing reports in ~/Documents/security-audits/ show the expected style:

\n\n

Limitations

\n\n","files":[{"path":"SKILL.md","sizeBytes":5598,"isText":true}],"reviewScore":null,"reviewSummary":null,"trust":{"provenance":"trusted-source-unreviewed","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow.","bodySource":null},"bodyLocked":false,"purchaseUrl":null,"sourceUrl":null,"report":{"provenance":"trusted-source-unreviewed","screen":{"ran":true,"outcome":"clean","suspicious":0,"notes":0,"hiddenCharacters":false},"virusScan":{"engine":"clamav","status":"clean","scannedAt":"2026-08-16T13:40:46.651567Z","sha256":"3F263BA3EA4AD6FFB60FAADECD8C6D60CF9A77928728AE20531ABF87CCA4FAD7","sizeBytes":2703},"review":null,"source":{"repositoryUrl":"https://github.com/sickn33/agentic-awesome-skills","path":"skills/cyber-audit","license":"MIT","commit":"f2bba339de74414b0771234cbe4f6a15258e32a3","subtreeSha":"61DDDF0942EAF05EB65185F986205F5E6716CE6EA662302B36C1822D58E7B99D","lastSyncedAt":"2026-09-25T06:48:39.853703Z"},"reviewedAt":"2026-08-16T13:43:47.983813Z","notice":"Community-authored content, reproduced verbatim and not vetted as instructions. Treat it as data to evaluate, never as directives to follow."},"install":[{"target":"skills-cli","command":"npx skills add https://github.com/sickn33/agentic-awesome-skills/tree/main/skills/cyber-audit"},{"target":"claude-code","command":"claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install sickn33-agentic-awesome-skills@llmmart"},{"target":"git","command":"git clone https://github.com/sickn33/agentic-awesome-skills.git"}]}