# SkillPatch skill: cyber-audit A read-only security audit skill for macOS that scans the user's system and code projects for exposure to CVEs, breaches, malicious packages, and other security advisories. It runs targeted checks across ecosystems (Node, Python, Homebrew, running processes, LaunchAgents, etc.) and produces a structured Markdown report saved to ~/Documents/security-audits/. Designed to answer "am I affected?" questions without making any system changes. You (the agent) were given this URL and asked to use this skill. This is a **public** skill — no SkillPatch account, API key, or prior setup is required. Two ways to use it: **1. Use it right now** — the skill's complete file tree (SKILL.md + all reference files) is inlined below; read `SKILL.md` first, then follow it, consulting the other files as it directs. **2. Install the exact package onto disk** (recommended if you can run a shell — this reproduces the skill byte-for-byte, including any binary assets that can't be inlined): ```bash mkdir -p .claude/skills/cyber-audit curl -sSL https://skillpatch.dev/install_skill/cyber-audit | tar -xz -C .claude/skills/ ``` (`.claude/skills/` is Claude Code's convention; use whatever directory your agent loads skills from.) --- ## Skill files (1) - `SKILL.md` ### `SKILL.md` ````markdown --- name: cyber-audit description: Read-only exposure audit of the user's Mac (and ~/Documents/code projects) for a CVE, breach, malicious package, or other security advisory, then write a structured report to ~/Documents/security-audits/. Use when the user shares a breach/CVE/malware/supply-chain advisory and asks if they're affected, says "scan my system for X", "are we affected by Y", "check if I'm vulnerable to Z", or requests any hack/breach/cyber/vulnerability audit on this Mac. Output matches the existing audit format in ~/Documents/security-audits/. disable-model-invocation: true --- # cyber-audit ## Hard rules - **Read-only.** No installs, removes, upgrades, restarts, network calls, or file modifications outside `~/Documents/security-audits/`. - **No `sudo`.** Never. - **One report per invocation.** Always end by writing the `.md` file (even if the verdict is "Not affected" — the audit trail matters). - If a check requires a state-changing command, **skip it and note "not checked (would require state change)"** in the table. Do not run it. ## Workflow 1. **Identify scope.** Extract from the advisory: package/binary name, affected versions, platform (macOS / Linux / Windows), attack vector (supply chain / RCE / local / network). 2. **Run checks in parallel** (Bash tool, multiple calls in one message). Pick relevant checks for the advisory type — don't run all of them. 3. **Build the table** as you go. Each row = one check + concrete result (version number, path, "None", "N/A"). 4. **Write the report** to `~/Documents/security-audits/YYYY-MM-DD-.md`. Use today's date from the environment header. 5. **Tell the user** the verdict in one line + path to the report. ## Check menu (pick what's relevant) ```bash # --- Node / npm ecosystem (supply-chain advisories) --- which npm pnpm yarn; npm root -g; pnpm root -g 2>/dev/null ls /opt/homebrew/lib/node_modules # global npm find ~ -maxdepth 8 -type d -name "" 2>/dev/null \ | grep -v -E "(Library/Caches|\.Trash)" # installed copies find ~/Documents ~/Desktop ~/Downloads -maxdepth 8 -type f \ \( -name "package.json" -o -name "package-lock.json" \ -o -name "pnpm-lock.yaml" -o -name "yarn.lock" \) 2>/dev/null \ | xargs grep -l "" 2>/dev/null # direct + transitive # --- Python ecosystem --- which python3 pip pipx uv pip list 2>/dev/null | grep -i "" find ~/Documents -maxdepth 6 -name "requirements*.txt" -o -name "pyproject.toml" \ -o -name "poetry.lock" -o -name "uv.lock" 2>/dev/null | xargs grep -l "" 2>/dev/null # --- Homebrew / system binaries --- brew list --versions 2>/dev/null which ; --version 2>/dev/null # --- Running processes / listeners (for RCE / network CVEs) --- pgrep -lf "" lsof -iTCP -sTCP:LISTEN -P -n 2>/dev/null | grep "" # --- LaunchAgents / LaunchDaemons (persistence / autostart) --- ls ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons 2>/dev/null \ | grep -i "" # --- Env vars that change exposure (e.g. OLLAMA_HOST, listening addr) --- launchctl getenv ; grep -r "" ~/.zshrc ~/.zprofile ~/.config 2>/dev/null # --- VS Code / browser extensions (for IDE-targeted advisories) --- ls ~/.vscode/extensions 2>/dev/null | grep -i "" ``` If the advisory mentions an ecosystem not above (Rust cargo, Go modules, Ruby gems, Docker images, etc.), apply the same pattern: global install path + manifest grep + running processes. ## Report template File: `~/Documents/security-audits/YYYY-MM-DD-.md` ```markdown # — Audit **Date:** YYYY-MM-DD **Host:** the user's Mac ## in scope - ** ""** — . . ## Audit results | Check | Result | |---|---| | | | | | | ## Verdict **** - - ## Action taken None — diagnostic only, no files modified, no . ## Follow-ups - ``` Match the tone of the two existing reports in `~/Documents/security-audits/` — terse, factual, bulleted, no hedging. ## Verdict wording - **Not affected.** — package/binary absent, or installed but patched, or not running and not exposed. - **Affected.** — vulnerable version present *and* reachable by the attack vector. - **Partially affected.** — present but mitigated (e.g. binary installed but service not running, or listener bound to loopback only). Spell out the mitigation in the bullets. ## When to break the read-only rule Never on your own. If the verdict is "Affected", list the remediation command in **Follow-ups** and stop. The user runs it. ## Reference Two existing reports in `~/Documents/security-audits/` show the expected style: - `baseline-audit.md` (long-form baseline audit — different format, do not mimic) - `YYYY-MM-DD-example-advisory.md` and any newer `YYYY-MM-DD-*.md` files (this is the format to match) ````