About absolute-audit
Absolute Audit is a repository security-audit skill for finding and triaging dependency CVEs and risky code patterns, then guiding fixes and verification. It is intended for defensive hardening of a user's own repository and produces severity-ranked findings with remediation steps.
Key features
- 01Scan dependencies for known CVEs
- 02Check code for high-risk patterns
- 03Rank findings by severity and reachability
- 04Apply scoped fixes and rerun scans
- 05Report secret locations without values
Use cases
- 01Audit a repository after a CVE disclosure
- 02Review dependency and code risks periodically
- 03Prioritize reachable vulnerabilities for remediation
- 04Verify fixes without suppressing findings
Install
Copy the command and run it in a terminal.
npx skills add https:/After installing, type/absolute-auditin Claude Code to confirm it loaded.
Bundled filesREADME.mdreferences/health-engine.md
Details
From the project READMEStart your first response with the 🔒 emoji.
Absolute Audit
Find and triage security problems across the repo — vulnerable dependencies (CVEs) and risky code patterns — then fix the ones worth fixing, safely. Output is a severity-ranked findings table with a remediation per item, not a raw scanner dump.
Runs the shared engine in references/health-engine.md — read it for the
DETECT → SCAN → TRIAGE → FIX → VERIFY → REPORT loop and the safety contract. This file
covers only what's specific to security auditing.
Authorized defensive use. This command audits the user's own repository to find and fix weaknesses. It is for hardening, not for attacking systems or evading detection.
When to use
- "Run a security audit", "are we vulnerable?", "check our deps for CVEs".
- After a CVE disclosure affecting something you use.
- Periodic hygiene on
main.
Distinct from the built-in /security-review (reviews the pending diff on your
branch) — audit scans the whole committed repo, deps included. They complement.
What it scans
1. Dependency vulnerabilities (CVEs) — primary:
| Ecosystem | Scanner |
|---|---|
| npm / pnpm / yarn | npm audit --json / pnpm audit --json / yarn npm audit --json |
| Python | pip-audit (preferred) or safety check |
| Go | govulncheck ./... |
| Cross-language | osv-scanner against the lockfile if available |
2. Code-level patterns — read-only grep/static pass for high-signal issues only:
hardcoded secrets/keys/tokens, eval/dynamic exec on input, SQL built by string
concatenation, missing authz checks on sensitive routes, disabled TLS verification, unsafe
deserialization, overly-broad CORS. Prefer the project's existing SAST/linter security
rules (eslint-plugin-security, bandit, gosec) if configured.
Report suspected leaked secrets but never print the secret value — reference
path:line and the kind.
Risk ranking (TRIAGE)
Rank by severity × exploitability × reachability, not raw CVSS:
| Severity | Default |
|---|---|
| Critical / High, reachable, fix available | fix now (wave 1) |
| Moderate, reachable | fix this pass |
| Low / not reachable from app code | report, usually defer |
| Transitive-only, no direct upgrade path | flag, note the blocking parent |
Mark each: is it reachable from the app's actual code paths? A CVE in an unused transitive branch is lower priority than a Moderate one on a hot path. State the fixed version or the mitigation for each.
Fix & verify
- Dep CVEs → resolve via the smallest version move that clears it (delegate the actual
bump mechanics to the
upgradeflow's per-ecosystem steps). Prefer patched minors; escalate to a major only when that's the only fix, and gate it. - Code issues → apply the concrete fix (parameterize the query, move the secret to env
- flag the leaked one for rotation, add the authz check). Each fix is its own small wave.
- After each wave, re-run the scanner: the finding must actually disappear, and tests/build stay green. Never resolve by suppressing/allowlisting the alert.
- Leaked live secrets: flag for rotation — removing from code doesn't undo exposure.
Gotchas
- Audit fatigue → blanket ignore. Triage by reachability instead of muting the scanner.
- Fixing a CVE by suppressing it. An allowlisted advisory is still a vulnerability.
- Printing the secret. Reference location + type only; never echo the value.
- Deleting a secret from code ≠ safe. It's in git history and was exposed — rotate it.
- Stopping at deps. Many real issues are in code, not the dependency tree — run both passes.
Companion commands
/absolute upgrade— does the actual version moves for vulnerable deps./security-review(built-in) — pair with this to also cover your pending diff./absolute work— if remediation is a real refactor (e.g. replacing an auth flow), hand off.