Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    audit fortress

    1

    A deterministic security audit corps for finding, fixing, and gating vulnerabilities in code and CI pipelines.

    $24.90

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    audit fortress

    audit fortress

    Example session with this skill installed

    Run a security sweep on the current repository and show me the Bounty Board.

    • Read your context and instructions
    • Compiled the audit fortress

    I have completed the security sweep of the repository. The audit corps analyzed the source code and CI configurations, identifying three high-priority findings. These have been recorded in the Bounty Board ledger.

    Bounty Board Audit Summary

    IDHunterExploit ClassStatusEvidence
    INJ-001Injection HunterSQL InjectionOpendb.execute() sink in auth.py:42 via user_id
    SEC-004Secrets HoundHardcoded TokenOpenPlaintext AWS key in .env.example
    SUP-012Supply-Chain SentryCI Over-privilegeOpenGITHUB_TOKEN set to write in deploy.yml

    Threat Model: Component Boundaries

    ComponentTrust BoundarySTRIDE ThreatMitigation
    Web APIExternal / PublicInformation DisclosureImplement rate limiting on /api/v1
    DB ConnectorInternal / VPCTamperingParameterized queries in auth.py
    CI PipelineRunner ContextElevation of PrivilegePin actions to SHAs, restrict permissions

    Next steps

    1. Run bastion fix INJ-001 to generate the parameterized query patch and pinning test.
    2. Review the deploy.yml workflow to restrict permissions: to contents: read.
    3. Execute bastion gate once fixes are applied to verify closure in the ledger.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Security debt accumulates faster than most teams can patch. This skill provides a deterministic security audit corps that finds vulnerabilities in your own code and CI configurations without the noise of generic scanners. It delivers evidence-backed findings including the exact sink, reachable path, and a minimal fix.

    What it does

    • Injection analysis identifies SQL, command, path, and template injection paths via taint analysis.
    • Authorization hunting maps endpoints to roles to detect missing checks and IDOR patterns.
    • Secrets detection locates credentials and tokens while providing specific rotation guidance.
    • Supply-chain review audits dependencies, lockfiles, and CI permissions for confusion patterns.
    • Threat modeling generates STRIDE tables and trust boundaries based on actual source code.
    • Regression pinning creates minimal patches and pinning tests to ensure closed findings stay closed.

    How it works

    1. Sweep the repository using bastion sweep to generate a list of findings with evidence chains.
    2. Model the attack surface with bastion threatmodel to visualize trust boundaries and STRIDE risks.
    3. Fix identified vulnerabilities using the bastion fix command to receive patch guidance and tests.
    4. Gate the project with bastion gate to verify closures and update the monotonic ledger.

    Frameworks & tools

    Built for Python 3.10+ environments. It analyzes any source language with deep support for Python, JavaScript, TypeScript, and CI configuration files.

    Why this beats prompting it yourself

    Generic prompts often hallucinate security risks or miss complex taint paths across multiple files. This skill uses a structured registry and the Bounty Board ledger to ensure every finding is backed by an evidence chain and a regression-proof closure gate.

    Use cases

    • Auditing a repository before a major release or production deployment.
    • Hardening CI/CD pipelines by scoping tokens and pinning action SHAs.
    • Preparing a verified audit trail for customers or compliance reviewers.
    • Detecting and rotating leaked secrets within the development history.

    Known limitations

    Requires Python 3.10 or higher. While it reads all source code, deep analysis is optimized for Python, JavaScript, and TypeScript.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scanned

    Verified clean today

    • Passed all security checks, Safe to install

    Requires

    Evil
    Python

    Listedtoday

    What's inside

    Frequently Asked Questions