Borrowing it
Nothing to install: this file belongs to itdove/devaiflow. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/itdove/devaiflow/main/.codex/prompts/security-audit.mdgit clone --depth 1 https://github.com/itdove/devaiflowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/itdove/devaiflow/security-audit)<a href="https://agentmods.dev/commands/itdove/devaiflow/security-audit"><img src="https://agentmods.dev/badge/commands/itdove/devaiflow/security-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/itdove/devaiflow/security-audit"><img src="https://agentmods.dev/badge/commands/itdove/devaiflow/security-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00020 | $0.00461 |
| Opus 5.5 | $0.00008 | $0.00184 |
| Sonnet 5.5 | $0.00004 | $0.00092 |
| Haiku 4.5 | $0.00002 | $0.00046 |
Grade A, and why
security-audit scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
interpolation (exec/execSync with template strings), SQL string concatenation, HTML What it actually says
Perform a layered security audit of: $ARGUMENTS (if empty: the whole project).
Use .wolf/anatomy.md to target files instead of scanning blindly, and check
.wolf/buglog.json for previously found security issues before re-reporting them.
Work through the layers in order. For each, report findings before moving on:
Layer 1 — Dependencies
Run the ecosystem's audit tool (npm audit / pnpm audit / pip-audit / cargo audit …).
Flag known-vulnerable versions and unmaintained packages that handle untrusted input.
Layer 2 — Secrets
Search for hardcoded credentials: API keys, tokens, passwords, connection strings,
private keys. Check committed env files, config files, and test fixtures. Verify
.gitignore covers secret-bearing files (.env*, *.pem, .key, credentials).
Layer 3 — Injection surfaces
Find every place external input reaches an interpreter: shell commands built by string interpolation (exec/execSync with template strings), SQL string concatenation, HTML injection/XSS sinks, path traversal (user input joined into fs paths), deserialization of untrusted data, SSRF (user-controlled URLs fetched server-side).
Layer 4 — AuthN / AuthZ
Map endpoints and privileged operations. Check: missing auth middleware, IDOR (object IDs without ownership checks), privilege escalation paths, session handling, CORS and CSRF posture, servers bound to 0.0.0.0 without auth.
Layer 5 — Report
Produce a severity-ranked table (Critical/High/Medium/Low): finding, file:line, attack
scenario, concrete fix. Log confirmed vulnerabilities to .wolf/buglog.json with tag
"security". Offer to fix Critical and High items immediately.
Rules: verify each finding against the actual code before reporting (no pattern-match-only findings); prefer minimal, targeted fixes; never weaken existing security to silence a warning.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 41 lines · 20 tokens per session scan A e6f7e0b7337c
security-audit is a command published in the GitHub repository itdove/devaiflow (2 stars, last pushed today), licensed Apache-2.0. It adds 20 tokens to every session and 461 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-25.
Other commands, from other repositories
cli-anything-web:list
List all available CLI-Anything-Web CLIs (installed and generated).
jira-discover-project
Discover JIRA project context for intelligent defaults and usage patterns.
rad-migrate
Migrate a YouTube channel to Rad TV.
jira-assistant-setup
Set up JIRA Assistant Skills with credentials and configuration.
checklist
Generate a custom checklist for the current feature based on user requirements.
clarify
Identify underspecified areas in the current feature spec by asking up to 5 highly targeted clarification questions and encoding answers back into the spec.