security-audit
Audit a codebase or directory for security issues (hardcoded secrets, injection, unsafe deserialization, weak crypto, authz gaps) and produce a structured findings report. Use when the user asks for a security review, an audit, or to check code for vulnerabilities. Report only — never fix.
git clone --depth 1 https://github.com/omnigent-ai/omnigent /tmp/security-audit && cp -r /tmp/security-audit/examples/sentinel/skills/security-audit ~/.claude/skills/security-auditSKILL.md
# security-audit — review code for security issues, report only
## 1. Collect scope
Identify what to audit (a directory, a diff, a module). Gather it yourself with
sys_os_* / git — this is plumbing, not investigation.
## 2. Dispatch the scanner (purpose: explore / search)
Hand the scanner the scope; it reads source, manifests, history and returns
per-finding evidence. Do NOT sprawl across the repo yourself.
## 3. Synthesize the draft — FINDINGS TEMPLATE (must match orchestrator prompt)
For each finding:
### <Severity>: <short title>
- **Severity**: Critical | High | Medium | Low | Info
- **Location**: file:line
- **Recommendation**: <fix guidance — describe it, never apply it>
- **Confidence**: high | medium | low
## 4. Cross-vendor review (purpose: review)
Route the draft through the reviewer (codex, different vendor) to confirm true
positives and drop false positives. Fold in its verdicts.
## 5. Deliver
Present the final report. You REPORT; you never edit, patch, or fix code.Spin up a live local Omnigent server + runner and exercise the native Antigravity (agy) TUI harness (antigravity-native) end-to-end — launch the real `agy` CLI via `omnigent antigravity`, drive turns through the web UI, smoke-test, and bug-bash. Load when developing, testing, or debugging the antigravity-native harness (omnigent/inner/antigravity_native_executor.py, omnigent/antigravity_native.py, antigravity_native_bridge.py, antigravity_native_rpc.py, antigravity_native_reader.py, antigravity_native_launch.py) or its agy launch / RPC mirror / tmux delivery / OAuth / MCP-relay behavior. NOT the in-process `antigravity` Gemini SDK harness.
Spin up a live local Omnigent server and exercise the Antigravity (Gemini) SDK harness end-to-end — build antigravity agents, run real turns, smoke-test, and bug-bash. Load when developing, testing, or debugging the antigravity harness (omnigent/inner/antigravity_executor.py, antigravity_harness.py, omnigent/onboarding/antigravity_auth.py) or its auth / model / tool-bridge behavior.
Document a module or public API surface (functions, classes, CLI commands, endpoints) from the code itself. Use when the user asks for API reference, to document a module, or to write usage docs for a public interface.
Patterns and templates for generating valid Omnigent agent directories. Load when ready to create files.
Verify the Omnigent CLI's setup/onboarding flow, terminal UI/UX, and critical user journeys in a completely isolated, reproducible loop. Drives the real `omnigent` binary through a PTY (pexpect) inside a throwaway OMNIGENT_CONFIG_HOME / OMNIGENT_DATA_DIR sandbox that never touches the user's real ~/.omnigent, captures ANSI-stripped frames for UX inspection, and proves a change is verifiable via a before→fix→after baseline diff. Load when developing or reviewing a CLI setup/onboarding/REPL/picker change (omnigent/cli.py, omnigent/onboarding/*, omnigent/repl/*, scripts/install_oss.sh), reproducing a cold-start/first-run UX bug, or confirming a fix actually lands. Several agents can run it concurrently on separate worktrees.
Test counter — codex skills e2e. The unique suffix b8d4e7 appears in the skill name so a string match in the agent's output proves codex loaded this skill.
Test greeter — codex skills e2e. The unique suffix a3f9c2 appears in the skill name so a string match in the agent's output proves codex loaded this skill.
Spin up a live local Omnigent server and exercise the GitHub Copilot SDK harness end-to-end — build copilot agents, run real turns, smoke-test, and bug-bash. Load when developing, testing, or debugging the copilot harness (omnigent/inner/copilot_executor.py, copilot_harness.py, omnigent/onboarding/copilot_auth.py) or its auth / model / tool-bridge behavior.