cyber-audit

cyber-audit

When to Use

• Use when the user asks whether their machine or projects are affected by a CVE, breach, or package advisory.
• Use when a read-only local security exposure report is appropriate.

Hard rules

• Read-only. No installs, removes, upgrades, restarts, network calls, or file modifications outside ~/Documents/security-audits/.
• No sudo. Never.
• One report per invocation. Always end by writing the .md file (even if the verdict is "Not affected" — the audit trail matters).
• If a check requires a state-changing command, skip it and note "not checked (would require state change)" in the table. Do not run it.

Workflow

1. Identify scope. Extract from the advisory: package/binary name, affected versions, platform (macOS / Linux / Windows), attack vector (supply chain / RCE / local / network).
2. Run checks in parallel (Bash tool, multiple calls in one message). Pick relevant checks for the advisory type — don't run all of them.
3. Build the table as you go. Each row = one check + concrete result (version number, path, "None", "N/A").
4. Write the report to ~/Documents/security-audits/YYYY-MM-DD-<short-kebab-slug>.md. Use today's date from the environment header.
5. Tell the user the verdict in one line + path to the report.

Check menu (pick what's relevant)

# --- Node / npm ecosystem (supply