New: 97,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Absolute Audit

by maddhruv in maddhruv/absolute

Vulnerability and security scan (defensive, your own repo): dependency CVEs plus risky code patterns (secrets, injection, weak authz), severity x reachability triaged and remediated without…

MITAuto-check passedSecurity

Install Absolute Audit

skills CLI
$ npx skills add maddhruv/absolute --skill absolute-audit -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install maddhruv/absolute absolute-audit --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/maddhruv/absolute.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/absolute-audit .claude/skills/absolute-audit && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
absolute-audit
GitHub stars
218
Used in
1 other repo
Token cost
~1.2k tokens
SKILL.md length
550 words
Files
3 (incl. references)
Skills in repo
10
Repo updated
First seen
Licence
MIT

At a glance

Vulnerability and security scan (defensive, your own repo): dependency CVEs plus risky code patterns (secrets, injection, weak authz), severity x reachability triaged and remediated without…

  • Works in 5 steps: Audit fatigue → blanket ignore. Triage… → Fixing a CVE by suppressing it. An… → Printing the secret. Reference location… → …
  • Are we vulnerable
  • SKILL.md covers Absolute Audit, When to use, What it scans and Risk ranking (TRIAGE), plus 3 more sections
  • Calls npm, pnpm and yarn

What it does

Absolute Audit is an agent skill from maddhruv/absolute. Vulnerability and security scan (defensive, your own repo): dependency CVEs plus risky code patterns (secrets, injection, weak authz), severity x reachability triaged and remediated without suppressing. Complements the built-in /security-review. Triggers on "absolute audit", "security audit", "are we vulnerable", "scan for CVEs", "check for secrets/injection", "harden this".

Its SKILL.md is about 1.2k tokens, which your agent loads only when the skill is triggered. The skill folder holds 3 other files, including reference files (for example `README.md` and `references/health-engine.md`).

It sits in Security, covering Security review, Vulnerability scanning and Authorization and RBAC. The repository describes itself as: Absolute Skills to 10x your Development Lifecycle. The licence is MIT.

When your agent uses it

  • Are we vulnerable
  • Check for secrets/injection

Example prompts

  • “absolute audit”
  • “security audit”
  • “are we vulnerable”
  • “/absolute-audit”

Requirements

  • Python 3

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

  1. Audit fatigue → blanket ignore. Triage by reachability instead of muting the scanner.
  2. Fixing a CVE by suppressing it. An allowlisted advisory is still a vulnerability.
  3. Printing the secret. Reference location + type only; never echo the value.
  4. Deleting a secret from code ≠ safe. It's in git history and was exposed — rotate it.
  5. Stopping at deps. Many real issues are in code, not the dependency tree — run both passes.

What it can do on your machine

Read from SKILL.md and the folder at commit 2166274. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • npm
    • pnpm
    • yarn

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use npm, pnpm and yarn, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Absolute Audit loads about 1.2k tokens when it runs, and up to ~2.5k if it reads all its reference files. Until then it costs about 98 tokens; SKILL.md has 550 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~98
When it runs · the whole SKILL.md, loaded when a task matches
~1.2k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~2.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from maddhruv/absolute at commit 2166274, republished under its MIT licence (© maddhruv). 550 words, ~1,169 tokens.

Download SKILL.mdSave it as .claude/skills/absolute-audit/SKILL.md (or your agent's skills folder). This skill also uses 2 other files; get the full folder from GitHub.
name
absolute-audit
description
Vulnerability and security scan (defensive, your own repo): dependency CVEs plus risky code patterns (secrets, injection, weak authz), severity x reachability triaged and remediated without suppressing. Complements the built-in /security-review. Triggers on "absolute audit", "security audit", "are we vulnerable", "scan for CVEs", "check for secrets/injection", "harden this".
version
0.5.0
category
workflow
tags
workflow, security, audit, vulnerabilities, cve
platforms
claude-code, gemini-cli, openai-codex, mcp
user-invocable
true
argument-hint
[target]
license
MIT

Start your first response with the 🔒 emoji.

Absolute Audit

Find and triage security problems across the repo — vulnerable dependencies (CVEs) and risky code patterns — then fix the ones worth fixing, safely. Output is a severity-ranked findings table with a remediation per item, not a raw scanner dump.

Runs the shared engine in references/health-engine.md — read it for the DETECT → SCAN → TRIAGE → FIX → VERIFY → REPORT loop and the safety contract. This file covers only what's specific to security auditing.

Authorized defensive use. This command audits the user's own repository to find and fix weaknesses. It is for hardening, not for attacking systems or evading detection.

When to use

  • "Run a security audit", "are we vulnerable?", "check our deps for CVEs".
  • After a CVE disclosure affecting something you use.
  • Periodic hygiene on main.

Distinct from the built-in /security-review (reviews the pending diff on your branch) — audit scans the whole committed repo, deps included. They complement.

What it scans

1. Dependency vulnerabilities (CVEs) — primary:

EcosystemScanner
npm / pnpm / yarnnpm audit --json / pnpm audit --json / yarn npm audit --json
Pythonpip-audit (preferred) or safety check
Gogovulncheck ./...
Cross-languageosv-scanner against the lockfile if available

2. Code-level patterns — read-only grep/static pass for high-signal issues only: hardcoded secrets/keys/tokens, eval/dynamic exec on input, SQL built by string concatenation, missing authz checks on sensitive routes, disabled TLS verification, unsafe deserialization, overly-broad CORS. Prefer the project's existing SAST/linter security rules (eslint-plugin-security, bandit, gosec) if configured.

Report suspected leaked secrets but never print the secret value — reference path:line and the kind.

Risk ranking (TRIAGE)

Rank by severity × exploitability × reachability, not raw CVSS:

SeverityDefault
Critical / High, reachable, fix availablefix now (wave 1)
Moderate, reachablefix this pass
Low / not reachable from app codereport, usually defer
Transitive-only, no direct upgrade pathflag, note the blocking parent

Mark each: is it reachable from the app's actual code paths? A CVE in an unused transitive branch is lower priority than a Moderate one on a hot path. State the fixed version or the mitigation for each.

Show full SKILL.md (215 more words)Show less

Fix & verify

  • Dep CVEs → resolve via the smallest version move that clears it (delegate the actual bump mechanics to the upgrade flow's per-ecosystem steps). Prefer patched minors; escalate to a major only when that's the only fix, and gate it.
  • Code issues → apply the concrete fix (parameterize the query, move the secret to env
    • flag the leaked one for rotation, add the authz check). Each fix is its own small wave.
  • After each wave, re-run the scanner: the finding must actually disappear, and tests/build stay green. Never resolve by suppressing/allowlisting the alert.
  • Leaked live secrets: flag for rotation — removing from code doesn't undo exposure.

Gotchas

  1. Audit fatigue → blanket ignore. Triage by reachability instead of muting the scanner.
  2. Fixing a CVE by suppressing it. An allowlisted advisory is still a vulnerability.
  3. Printing the secret. Reference location + type only; never echo the value.
  4. Deleting a secret from code ≠ safe. It's in git history and was exposed — rotate it.
  5. Stopping at deps. Many real issues are in code, not the dependency tree — run both passes.

Companion commands

  • /absolute upgrade — does the actual version moves for vulnerable deps.
  • /security-review (built-in) — pair with this to also cover your pending diff.
  • /absolute work — if remediation is a real refactor (e.g. replacing an auth flow), hand off.

© maddhruv, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 2 other files (references) in skills/absolute-audit of maddhruv/absolute.

  • SKILL.md
  • README.md
  • references/health-engine.md

Open the folder on GitHubat commit 2166274

Used in 1 other repository

We found 1 copy of this SKILL.md (exact, near-identical or edited) in other folders, from 1 other GitHub owner. This page covers the copy in maddhruv/absolute, which our catalogue first saw on October 7, 2026.

Compare with similar skills

Absolute Audit next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Absolute Audit compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Absolute Audit this skillmaddhruv/absolute2181 repos~1.2kAutomated safety check: PassMIT
Security Checkgocronx-team/gocron808—~690Automated safety check: PassMIT
Security Reviewgithub/awesome-copilot40k1 repos~2.3kAutomated safety check: NotesMIT
Discover Securityrand/cc-polymath181—~1.9kAutomated safety check: PassMIT
Frontend Review Securitymizchi/skills356—~1.7kAutomated safety check: NotesNone
Deepsec Documentation Guidevercel-labs/deepsec8.1k—~956Automated safety check: PassApache-2.0

Similar skills

  • Security Check

    gocronx-team/gocron

    Audit or harden gocron security across Go, pnpm workspaces, containers, authentication, authorization, secrets, command execution, SSRF, and dependency vulnerabilities.

    808 GitHub stars~690 tokensUpdated 5 days ago
    SecurityAuto-check passed

  • Security Review

    github/awesome-copilot

    Official

    AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching…

    40k GitHub starsUsed in 1 repo~2.3k tokens
    SecurityAuto-check: notes

  • Discover Security

    rand/cc-polymath

    Automatically discover security skills when working with authentication, authorization, input validation, security headers, vulnerability assessment, or secrets management.

    181 GitHub stars~1.9k tokensUpdated 7 mo ago
    SecurityAuto-check passed

  • Frontend Review Security

    mizchi/skills

    A skill your agent uses when conducting a frontend security review — static analysis (risky HTML patterns, env var exposure), authentication/authorization audit (token storage, route guards…

    356 GitHub stars~1.7k tokensUpdated 5 days ago
    SecurityAuto-check: notes

  • Deepsec Documentation Guide

    vercel-labs/deepsec

    Official

    Points the agent at deepsec's own docs to answer questions about initializing, configuring, resuming, scanning with and extending the vulnerability scanner.

    8.1k GitHub stars~956 tokensUpdated 8 days ago
    SecurityAuto-check passed

  • Native Dependency Update

    mono/SkiaSharp

    Update native dependencies (libpng, libexpat, zlib, libwebp, harfbuzz, freetype, libjpeg-turbo, etc.) in SkiaSharp's Skia fork.

    5.6k GitHub stars~4.1k tokensUpdated today
    SecurityAuto-check passed

More from maddhruv/absolute

All 10 skills in this repo

  • Absolute Init

    maddhruv/absolute

    One-time setup for absolute: interview how you want it to behave (output style, autonomy, TDD strictness, spec dir, families) + detect the stack once, then write .absolute.config.json (project…

    218 GitHub starsUsed in 1 repo~3k tokens
    Auto-check passed

  • Absolute Spec

    maddhruv/absolute

    Lightweight standalone design spec for AI coding agents: codebase scan → bounded clarify pass (3–5 questions, not a grill) → reviewed design doc written to docs/plans/ → independent scored review →…

    218 GitHub starsUsed in 1 repo~2.3k tokens
    Auto-check passed

  • Absolute Simplify

    maddhruv/absolute

    A skill your agent uses when the user wants to simplify, clean up, refactor, tidy, or refine code — their staged/unstaged git changes or a target file/path.

    218 GitHub stars~6.1k tokensUpdated 3 mo ago
    Auto-check passed

  • Absolute Debt

    maddhruv/absolute

    Lint and typecheck debt paydown: clear pre-existing repo-wide lint/type violations and suppressions (@ts-ignore, type: ignore) one rule per wave, fixing causes not symptoms.

    218 GitHub starsUsed in 1 repo~1.1k tokens
    Auto-check passed

  • Absolute Work

    maddhruv/absolute

    End-to-end, phase-gated SDLC for AI coding agents: relentless design interview → reviewed spec → dependency-graphed task board → safe-wave TDD execution → verification → converge.

    218 GitHub stars~5.3k tokensUpdated 3 mo ago
    Auto-check passed

  • Absolute Deflake

    maddhruv/absolute

    Flaky test fixes: detect nondeterministic tests empirically (repeat/shuffle/parallel runs), diagnose the root cause, fix it — never retry/skip/sleep — and verify across many randomized runs.

    218 GitHub starsUsed in 1 repo~1.2k tokens
    Auto-check passed

Categories

Questions about Absolute Audit

What does Absolute Audit do?

Vulnerability and security scan (defensive, your own repo): dependency CVEs plus risky code patterns (secrets, injection, weak authz), severity x reachability triaged and remediated without…. Absolute Audit is an agent skill from maddhruv/absolute. Vulnerability and security scan (defensive, your own repo): dependency CVEs plus risky code patterns (secrets, injection, weak authz), severity x reachability triaged and remediated without suppressing.

When should I use Absolute Audit?

Absolute Audit fits situations like: are we vulnerable; check for secrets/injection.

How do I install Absolute Audit in Claude Code?

Run `npx skills add maddhruv/absolute --skill absolute-audit -a claude-code`. Or copy the skill folder (skills/absolute-audit in maddhruv/absolute) into .claude/skills/absolute-audit in your project. Claude Code loads it when a task matches its description.

How do I install Absolute Audit in Codex?

Run `npx skills add maddhruv/absolute --skill absolute-audit -a codex`. Or copy the skill folder (skills/absolute-audit in maddhruv/absolute) into .agents/skills/absolute-audit in your project. Codex loads it when a task matches its description.

Can I use Absolute Audit in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add maddhruv/absolute --skill absolute-audit -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/absolute-audit, .gemini/skills/absolute-audit, .github/skills/absolute-audit and .opencode/skills/absolute-audit in your project.

What does Absolute Audit need to run?

Going by SKILL.md and its folder, Absolute Audit needs the command-line tools its instructions call (npm, pnpm and yarn). Our summary lists: Python 3.

Does Absolute Audit access the network?

SKILL.md contains no URLs. Its commands use npm, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Absolute Audit safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Absolute Audit use?

Absolute Audit is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Absolute Audit use?

About 1.2k tokens (SKILL.md is roughly 4.7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 1.4k tokens, read only when the agent opens those files.

What are the alternatives to Absolute Audit?

Skills that share tags, products or a category with Absolute Audit: Security Check (gocronx-team/gocron, 808 stars), Security Review (github/awesome-copilot, 40k stars), Discover Security (rand/cc-polymath, 181 stars) and Frontend Review Security (mizchi/skills, 356 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Absolute Audit?

maddhruv (a GitHub user) maintains it in maddhruv/absolute, which has 218 GitHub stars. The repository holds 10 skills in this directory. The repository was last updated on July 6, 2026.

Source: maddhruv/absolute on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.