Claude Skill MartBrowse skillsQuick linesLearn by videoTerminal guideWhat is a Skill?
 
← Back to list

Absolute Audit

A defensive security-audit skill that scans your whole repo for dependency CVEs and risky code patterns, triages them by severity and reachability, then fixes them without suppressing alerts.

Security & ReviewIntermediate★ 206⑂ 31AI score 9/10Last updated: Jul 6, 2026

What it does

  • Runs ecosystem-appropriate scanners for dependency CVEs: npm/pnpm/yarn audit, pip-audit/safety, govulncheck, osv-scanner on lockfiles.
  • Does a read-only pass for high-signal code issues: hardcoded secrets, eval/dynamic exec on input, string-concatenated SQL, missing authz on sensitive routes, disabled TLS verification, unsafe deserialization, overly-broad CORS — reusing existing SAST rules (eslint-plugin-security, bandit, gosec) when configured.
  • Triages by severity × exploitability × reachability rather than raw CVSS, producing a ranked findings table with a concrete remediation per item.
  • Fixes in small waves, re-running the scanner after each so the finding actually disappears and tests/build stay green. Suppressing or allowlisting an advisory is explicitly forbidden.
  • Never prints secret values — reports path:line plus type and flags leaked secrets for rotation.

Who it's for

  • Developers and tech leads who want periodic security hygiene on main.
  • Teams reacting to a newly disclosed CVE that may affect their stack.
  • Anyone drowning in scanner noise who needs a prioritized, actionable list.
  • Users who want whole-repo coverage beyond the built-in /security-review diff check.

Example uses

  1. "Run a security audit" → severity-ranked findings table with a remediation for each entry.
  2. "Are we vulnerable? Scan our deps for CVEs" → vulnerable packages plus the smallest version bump that clears each advisory.
  3. "Check for secrets and injection" → locations reported as path:line, then parameterized queries applied and secrets moved to env with rotation reminders.

· · · Install guide · · ·

Try it now, no install

Paste this into Claude to use the skill without installing anything.

Read the instructions in this file and follow them to help me:
https://raw.githubusercontent.com/maddhruv/absolute/HEAD/skills/absolute-audit/SKILL.md

What I want: (describe your task here)

If Claude can't open the link, open it yourself and paste the contents instead.

↓ If it works for you, download the ZIP below and install it. Then it runs on its own — no pasting each time.

Install in the Claude app (no terminal)
  1. Download the ZIP with the button below.
  2. In Claude, open Settings → Capabilities and turn on 'Code execution and file creation'. (one time)
  3. Go to Customize → Skills → + → 'Upload a skill' and upload the ZIP.
↓ Download ZIP
Install in Claude Code

Let Claude do it — paste this into Claude Code

Install the skill I found on Claude Skill Mart.
Copy the skills/absolute-audit folder from the GitHub repo maddhruv/absolute into my ~/.claude/skills/absolute-audit/.
When it's done, tell me in one line what this skill can do.

Install with a command instead

git clone https://github.com/maddhruv/absolute.git && mkdir -p ~/.claude/skills && cp -r absolute/skills/absolute-audit ~/.claude/skills/

⚠ This is a third-party skill. Check the source repository before installing.

  1. Open a terminal.
  2. Clone the repository: git clone https://github.com/maddhruv/absolute.git
  3. Create the skills directory: mkdir -p ~/.claude/skills
  4. Copy the skill: cp -r absolute/skills/absolute-audit ~/.claude/skills/
  5. Confirm the bundled references/health-engine.md came along — it holds the shared DETECT → SCAN → TRIAGE → FIX → VERIFY → REPORT loop this skill relies on.
  6. Install the scanners you need: npm audit ships with npm; pip install pip-audit for Python; go install golang.org/x/vuln/cmd/govulncheck@latest for Go.
  7. Restart Claude Code, then type "absolute audit" or "security audit" to trigger it.
View source on GitHub ↗License: MIT