Low Severity
Published: Nov 5, 2026
Agent Skill for read-only, evidence-backed security audits with honest coverage verdicts. Install: npx skills add shivanathd/evidence-led-security-audit
# evidence-led-security-audit
[](https://github.com/shivanathd/evidence-led-security-audit/actions/workflows/test.yml)
[](LICENSE)
An [Agent Skill](https://agentskills.io) that turns "are we affected?" into an answer backed by evidence. It guides an AI agent (Claude Code, Codex, Cursor and others that read `SKILL.md`) through a read-only security audit of systems you are allowed to assess, and makes it report what it could not check instead of calling it clean.
It was written during the October 2026 PHP remote-code-execution release and the Railway environment-variable exposure, and works for any stack.
## Why
Agent-run security checks tend to fail in the same few ways:
- `php -v` on the CLI is taken as proof of what the web server runs.
- A scanner that never ran is reported as "0 findings".
- A fix merged in git is called done before the image is deployed.
- A leaked key is "fixed" by deleting it from the repo, without rotating or revoking it.
- One model role-playing three reviewers is presented as independent review.
This skill blocks each of these with explicit rules, and ships a validator that rejects reports that break them.
## Install
```bash
npx skills add shivanathd/evidence-led-security-audit
```
Install for Claude Code only, for all your projects:
```bash
npx skills add shivanathd/evidence-led-security-audit -a claude-code -g
```
Or clone the repository into your agent's skills directory (for Claude Code, `~/.claude/skills/`). Keep the folder name `evidence-led-security-audit`.
**Requirements:** Python 3.9 or newer, standard library only. Nothing to install, no network calls. `host_checks.py` runs on macOS, Linux and Windows. The other file helpers need macOS or Linux; on other hosts they stop with `BLOCKED` instead of running with weaker checks.
## Use it
Ask