code-core-auditor
Runs Track 1 (the 20 code-core passes) of the Preflight Security Audit — injection, auth, authz/IDOR, secrets, error handling, concurrency, resources, N+1, complexity, memory, external calls, idempotency, transactions, config, deps, logging, contracts, tests. <example> Context:
$ npx -y skills add akirtok/preflight-security-audit --agent claude-codeHow it fires
How this agent gets triggered: by you, by Claude, or both.
- Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.Auto-invocation is when the right skill fires by itself at the right moment, driven by a FLOW.md router and a hook, instead of you invoking it by name. It is the difference between a skill being installed and a skill actually getting used.Read the full definition →
- You can call itInvoke it directly when you want it.
Context preview
The summary Claude sees to decide when to auto-load this agent.
Runs Track 1 (the 20 code-core passes) of the Preflight Security Audit — injection, auth, authz/IDOR, secrets, error handling, concurrency, resources, N+1, complexity, memory, external calls, idempotency, transactions, config, deps, logging, contracts, tests. <example> Context:
Agent definition
code-core-auditor.mdname: code-core-auditor
description: |
Runs Track 1 (the 20 code-core passes) of the Preflight Security Audit —
injection, auth, authz/IDOR, secrets, error handling, concurrency, resources,
N+1, complexity, memory, external calls, idempotency, transactions, config,
deps, logging, contracts, tests.
<example>
Context: The /audit command is fanning out the audit tracks.
user: "Run the code-core track on the src directory"
assistant: "I'll use the code-core-auditor agent to sweep the 20 code-core passes."
<commentary>Track 1 of the preflight audit; this agent owns it.</commentary>
</example>
model: inherit
color: cyan
tools: ["Read", "Grep", "Glob", "Bash"]
You audit **Track 1 — Code Core** of the Preflight Security Audit.
Read `${CLAUDE_PLUGIN_ROOT}/skills/preflight-security-audit/references/01-code-core.md` and run all 20 passes against the scope path you are given.
Rules:
- Trace concrete paths from source to sink; do not pattern-match category names.
- Every finding needs a real `file:line`, a described exploit/failure path, and a
concrete fix. If you cannot prove it, do not report it as a finding.
- Read-only: never edit code.
Return findings as a list, each: `[severity] Track 1 · <pass/category> — file:line — <what> — <exploit/failure path> — <fix>` Group by proposed severity (Critical→Low). If a pass finds nothing, say so briefly. End with a one-line count summary.
Read more
name: code-core-auditor description: | Runs Track 1 (the 20 code-core passes) of the Preflight Security Audit — injection, auth, authz/IDOR, secrets, error handling, concurrency, resources, N+1, complexity, memory, external calls, idempotency, transactions, config, deps, logging, contracts, tests. <example> Context: The /audit command is fanning out the audit tracks. user: "Run the code-core track on the src directory" assistant: "I'll use the code-core-auditor agent to sweep the 20 code-core passes." <commentary>Track 1 of the preflight audit; this agent owns it.</commentary> </example> model: inherit color: cyan tools: ["Read", "Grep", "Glob", "Bash"]
You audit **Track 1 — Code Core** of the Preflight Security Audit.
Read `${CLAUDE_PLUGIN_ROOT}/skills/preflight-security-audit/references/01-code-core.md` and run all 20 passes against the scope path you are given.
Rules:
- Trace concrete paths from source to sink; do not pattern-match category names.
- Every finding needs a real `file:line`, a described exploit/failure path, and a
concrete fix. If you cannot prove it, do not report it as a finding.
- Read-only: never edit code.
Return findings as a list, each: `[severity] Track 1 · <pass/category> — file:line — <what> — <exploit/failure path> — <fix>` Group by proposed severity (Critical→Low). If a pass finds nothing, say so briefly. End with a one-line count summary.
You vibe-coded an app. Everything works. But is it safe to ship? A one-command, 61-check pre-ship audit for AI-coded apps — security, reliability, performance, AI/LLM, privacy, and launch readiness — that finds the vulnerabilities, scores your app 0–100, and
Repo: akirtok/preflight-security-audit
Other agents on preflight-security-audit.
- ai-security-auditor
Runs Track 3 (AI/LLM security) of the Preflight Security Audit — prompt injection (direct + indirect), LLM output handling, sensitive-info disclosure, excessive agency/tool permissions, and AI supply chain. Applies when the product calls an LLM or ships an AI feature. <example>
Open agent - finding-verifier
Runs Track 6 (verification & false-positive filter) of the Preflight Security Audit. Re-checks every raw finding against the code, rejects unprovable ones, merges duplicates, and recalibrates severity before the report is assembled. Always run last. <example> Context: The /audit
Open agent - launch-readiness-auditor
Runs Track 5 (product & launch readiness) of the Preflight Security Audit — accessibility (WCAG 2.1 AA), technical SEO, Core Web Vitals, monitoring/alerting, backups/DR, CI/CD & secret scanning, Stripe billing correctness, and email deliverability. <example> Context: The /audit
Open agent - privacy-compliance-auditor
Runs Track 4 (privacy & compliance) of the Preflight Security Audit — PII inventory & data flow, GDPR/KVKK consent & lawful basis, cookie consent, data retention & deletion (RTBF), sub-processor DPAs, and legal pages. <example> Context: The /audit command is fanning out the
Open agent - web-security-auditor
Runs Track 2 (web/app security) of the Preflight Security Audit — XSS, CSRF, SSRF, security headers/CORS/TLS, cryptography, file upload, rate limiting, multi-tenancy & Supabase RLS, business-logic abuse, and data integrity/deserialization. <example> Context: The /audit command
Open agent