技能 universal-audit
📦
universal-audit
v1.0.3 內容修訂 r2 安全 🌐 網路存取📁 檔案系統存取⚙️ 外部命令
Audit Software Releases with Evidence
Release decisions often rely on incomplete evidence and inconsistent standards. This skill applies structured controls, deterministic scoring, and mandatory gates to assess readiness.
支援: Claude Codex Code(CC)
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "universal-audit" from https://skillstore.io/skills/glenskii-universal-audit.md and its manifest at https://skillstore.io/api/skills/glenskii-universal-audit/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「universal-audit」。 Audit this release at standard depth for a public web application.
預期結果:
- Verdict: Requires rework because two release gates remain unresolved.
- Coverage: 87 percent overall, with security and reliability above required thresholds.
- Top actions: close the authorization gap, verify recovery, and resolve the high-severity access-control finding.
正在使用「universal-audit」。 Compare this build with the previous audit.
預期結果:
- Four findings are remediated, one is partially remediated, and one has regressed.
- The current build improves quality coverage but still lacks verified rollback evidence.
- The release remains conditionally eligible after independent challenge.
安全審計
安全v2 • 2026/8/9 開啟版本化報告
All 56 static findings are false positives caused by Markdown formatting, JSON Schema identifiers, audit terminology, or expected local artifact output. The reviewed procedures require authorization for active testing, default to passive inspection, and prohibit unsafe or unauthorized actions.
18
已掃描檔案
2,534
分析行數
0
複核項目
0
已忽略的誤報
風險因素
🌐 網路存取 (4)
📁 檔案系統存取 (1)
最近一次完成的靜態與語意稽核未偵測到已確認的安全發現。這並不能證明該 Skill 沒有副作用。
審計單位: codex 檢視審計紀錄 →
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/glenskii-universal-audit/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/glenskii-universal-audit?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/glenskii-universal-audit?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/glenskii-universal-audit/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/glenskii-universal-audit.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
glenskii. (2026). universal-audit security audit report (audit version 2) [Author version 1.0.3]. Skillstore. https://skillstore.io/skills/glenskii-universal-audit/audits/2BibTeX 引用
@techreport{glenskii-glenskii-universal-audit-2026,
author = {glenskii},
title = {universal-audit security audit report (audit version 2)},
institution = {Skillstore},
year = {2026},
number = {2},
url = {https://skillstore.io/skills/glenskii-universal-audit/audits/2},
note = {Author version 1.0.3}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "universal-audit security audit report (audit version 2)"
version: "1.0.3"
type: report
authors:
- name: "glenskii"
date-released: "2026-08-09"
url: "https://skillstore.io/skills/glenskii-universal-audit/audits/2"
identifiers:
- type: other
value: "skillstore:glenskii-universal-audit:audit:2"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 100
架構
100
可維護性
87
內容
65
社群
91
規範符合度
你可以打造什麼
Prepare a release decision
Assess a candidate release against evidence coverage, quality controls, and mandatory gates before deployment.
Run a structured security review
Evaluate security and privacy controls while recording authorization, evidence, limitations, and remediation priorities.
Measure production readiness
Compare engineering quality across architecture, reliability, operations, accessibility, performance, and delivery practices.
試試這些提示
Start a rapid audit
Run a rapid audit of this repository. Begin with scope, authorization, product profile, and missing intake information.
Assess release readiness
Perform a standard production-readiness audit for this release. Record evidence, limitations, control statuses, scores, coverage, findings, and release gates.
Review a sensitive system
Plan a deep audit for this data-sensitive system. Define required access, evidence, controls, authorization boundaries, and independent verification.
Re-audit remediation
Re-audit the supplied prior findings against the current build. Verify remediation, regressions, remaining risks, current evidence, and changed scores.
最佳實務
- Define scope, authorization, environment, depth, and product profile before selecting controls.
- Use affirmative, sanitized evidence and mark unsupported claims as unverified.
- Keep scores separate from mandatory gates and independent review outcomes.
避免
- Do not treat scanner silence or missing evidence as a passed control.
- Do not run active tests outside explicit rules of engagement.
- Do not remove applicable controls to improve coverage or scores.
常見問題
What audit depths are supported?
Rapid supports early screening, standard supports normal release decisions, and deep supports high-consequence or high-assurance reviews.
Does the skill perform penetration testing?
It defaults to passive inspection. Active testing requires explicit authorization and may still require a qualified specialist.
How are release scores calculated?
A bundled Python script applies category weights, control criticality, coverage rules, score caps, and mechanical release gates.
Can a high score override a serious finding?
No. Mandatory gates and unresolved critical or high findings constrain the verdict regardless of the numeric score.
What happens when evidence is unavailable?
The affected control remains unverified, and the missing evidence appears in audit limitations and coverage calculations.
What artifacts does the skill produce?
It produces a manifest, selected controls, evidence ledger, findings, scores, risk register, verification log, and final report.