security-audit
Audit a codebase or directory for security issues (hardcoded secrets, injection, unsafe deserialization, weak crypto, authz gaps) and produce a structured findings report. Use when the user asks for a security review, an audit, or to check code for vulnerabilities. Report only — never fix.
git clone --depth 1 https://github.com/omnigent-ai/omnigent /tmp/security-audit && cp -r /tmp/security-audit/examples/sentinel/skills/security-audit ~/.claude/skills/security-auditSKILL.md
# security-audit — review code for security issues, report only
## 1. Collect scope
Identify what to audit (a directory, a diff, a module). Gather it yourself with
sys_os_* / git — this is plumbing, not investigation.
## 2. Dispatch the scanner (purpose: explore / search)
Hand the scanner the scope; it reads source, manifests, history and returns
per-finding evidence. Do NOT sprawl across the repo yourself.
## 3. Synthesize the draft — FINDINGS TEMPLATE (must match orchestrator prompt)
For each finding:
### <Severity>: <short title>
- **Severity**: Critical | High | Medium | Low | Info
- **Location**: file:line
- **Recommendation**: <fix guidance — describe it, never apply it>
- **Confidence**: high | medium | low
## 4. Cross-vendor review (purpose: review)
Route the draft through the reviewer (codex, different vendor) to confirm true
positives and drop false positives. Fold in its verdicts.
## 5. Deliver
Present the final report. You REPORT; you never edit, patch, or fix code.Spin up a live local Omnigent server and exercise the Antigravity (Gemini) SDK harness end-to-end — build antigravity agents, run real turns, smoke-test, and bug-bash. Load when developing, testing, or debugging the antigravity harness (omnigent/inner/antigravity_executor.py, antigravity_harness.py, omnigent/onboarding/antigravity_auth.py) or its auth / model / tool-bridge behavior.
Spin up a live local Omnigent server and exercise the Cursor SDK harness end-to-end — build cursor agents, run real turns, smoke-test, and bug-bash. Load when developing, testing, or debugging the cursor harness (omnigent/inner/cursor_executor.py, cursor_harness.py, cursor_auth.py) or its auth / model / tool-bridge behavior.
Run the Omnigent server as a Docker compose stack (server + Postgres) on any Docker host — your laptop, a VPS, EC2 by hand, or as the base layer of any container-platform deploy. Invoke when the user wants to build the image, bring up the compose stack, debug the stack on a host they already have, or extend the stack for a new platform.
Have the Claude and GPT partners critique each other's answers across a configurable number of rounds (default 1) before converging on a synthesis. Use when the user wants the two perspectives stress-tested against each other, not just shown side by side.
Verify an implementer's diff with an INDEPENDENT, different-vendor sub-agent (diff plus contract only); turn blocking issues into fix-tasks and loop until clean.
Run independent subtasks in parallel — one git worktree and one implementation sub-agent per task, each opening its own PR — then cross-review every PR. polly never merges; the human does.
Delegate read-only investigation, debugging, audit, search, or code-understanding tasks to sub-agents; synthesize only from their structured reports.
Patterns and templates for generating valid Omnigent agent directories. Load when ready to create files.