Individual skill
deep-app-audit
Deep audit of a Frappe app for security, correctness, and customization defects. Runs every security scope and every quality rule in a separate agent, verifies each candidate in a fresh context, and compiles one report. User-invoked only - run /deep-app-audit [app path] [options].
skills/deep-app-audit/SKILL.md
Source commit 5dc2f984081f6d8e23559af03b0e7c2799245d79
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 6, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 164
- Repository last updated
- Nov 6, 2026
- License
- Not available
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- security Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 21,733 bytesSKILL.mdcore · 21,733 bytesSKILL.mdcore · 21,733 bytesSKILL.mdcore · 21,733 bytesSKILL.mdcore · 21,733 bytesagents.example.jsonasset · 1,059 bytesprompts/check.mddoc · 1,514 bytesprompts/context.mddoc · 3,895 bytesprompts/report.mddoc · 4,349 bytesprompts/scan.mddoc · 1,714 bytesprompts/verify.mddoc · 1,461 bytesquality/A-customization/A01-no-monkey-patching.mddoc · 2,117 bytesquality/A-customization/A02-override-class-calls-super.mddoc · 2,299 bytesquality/A-customization/A03-extend-instead-of-override.mddoc · 1,959 bytesquality/A-customization/A04-regional-override-first.mddoc · 1,501 bytesquality/A-customization/A05-override-whitelisted-method-contract.mddoc · 1,936 bytesquality/A-customization/A06-hook-the-transaction-not-the-ledger.mddoc · 2,256 bytesquality/A-customization/A07-reuse-the-existing-doctype.mddoc · 2,352 bytesquality/A-customization/A08-custom-fields-in-code.mddoc · 2,187 bytesquality/A-customization/A09-fixtures-overwrite-the-site.mddoc · 1,913 bytesquality/A-customization/A10-remove-customizations-on-uninstall.mddoc · 1,911 bytesquality/A-customization/A11-declare-required-apps.mddoc · 2,251 bytesquality/A-customization/A12-declare-versions-and-branches.mddoc · 1,811 bytesquality/A-customization/A13-clean-bench-install.mddoc · 1,760 bytesquality/A-customization/A14-dotted-paths-must-resolve.mddoc · 2,364 bytesquality/A-customization/A15-scheduler-method-path-is-an-api.mddoc · 2,204 bytesquality/A-customization/A16-prefix-custom-fieldnames.mddoc · 2,092 bytesquality/A-customization/A17-keep-standard-field-constraints.mddoc · 2,286 bytesquality/A-customization/A18-check-every-writer.mddoc · 2,174 bytesquality/A-customization/A19-bound-the-custom-field-count.mddoc · 2,108 bytesquality/A-customization/A20-server-side-rules-not-in-client-scripts.mddoc · 2,478 bytesquality/A-customization/A22-app-logic-not-in-server-scripts.mddoc · 2,098 bytesquality/A-customization/A24-hooks-py-is-static-data.mddoc · 2,315 bytesquality/A-customization/A25-handler-signature-matches-call-site.mddoc · 4,200 bytesquality/A-customization/A26-hook-return-value-contract.mddoc · 2,310 bytesquality/A-customization/A27-last-wins-hooks-must-yield.mddoc · 2,253 bytesquality/A-customization/A28-permission-hooks-only-narrow.mddoc · 2,414 bytesquality/A-customization/A29-virtual-doctype-contract.mddoc · 2,569 bytesquality/A-customization/A30-no-code-for-a-custom-doctype.mddoc · 1,829 bytesquality/A-customization/A31-default-print-format-property-setter.mddoc · 1,945 bytesquality/A-customization/A32-templates-read-data.mddoc · 2,179 bytesquality/A-customization/A33-protect-setup-from-company-deletion.mddoc · 1,626 bytesquality/A-customization/A34-support-accounting-dimensions.mddoc · 2,145 bytesquality/A-customization/A35-ignore-links-on-delete-is-for-logs.mddoc · 1,697 bytesquality/A-customization/A38-frappe-call-targets-resolve.mddoc · 2,109 bytesquality/A-customization/A39-install-hooks-return-nothing.mddoc · 1,730 bytesquality/A-customization/A40-ship-desk-artefacts-as-files.mddoc · 2,013 bytesquality/A-customization/A41-no-direct-ledger-writes.mddoc · 2,729 bytesquality/B-correctness/B01-no-transaction-control-in-lifecycle.mddoc · 4,000 bytesquality/B-correctness/B02-own-the-rollback-you-catch.mddoc · 2,327 bytesquality/B-correctness/B03-ddl-ends-the-transaction.mddoc · 2,184 bytesquality/B-correctness/B04-enqueue-after-commit.mddoc · 1,826 bytesquality/B-correctness/B05-check-then-insert-is-a-race.mddoc · 2,079 bytesquality/B-correctness/B06-lock-the-rows-you-change.mddoc · 2,182 bytesquality/B-correctness/B07-fixed-lock-order.mddoc · 1,703 bytesquality/B-correctness/B08-idempotent-endpoint-and-job.mddoc · 2,297 bytesquality/B-correctness/B09-computed-field-is-a-function-of-input.mddoc · 1,898 bytesquality/B-correctness/B10-rebuild-a-child-table.mddoc · 1,608 bytesquality/B-correctness/B11-patch-must-be-rerunnable.mddoc · 2,657 bytesquality/B-correctness/B12-reload-doctype-before-a-patch-reads-it.mddoc · 1,929 bytesquality/B-correctness/B13-schema-change-needs-a-data-patch.mddoc · 2,025 bytesquality/B-correctness/B16-treat-every-read-as-possibly-empty.mddoc · 2,100 bytesquality/B-correctness/B17-coerce-at-the-boundary.mddoc · 2,402 bytesquality/B-correctness/B18-compare-money-at-field-precision.mddoc · 1,940 bytesquality/B-correctness/B19-compare-dates-as-dates.mddoc · 2,058 bytesquality/B-correctness/B20-single-doctype-value-api.mddoc · 2,064 bytesquality/B-correctness/B21-destructive-call-needs-a-filter.mddoc · 1,824 bytesquality/B-correctness/B25-one-owner-writes-status.mddoc · 2,029 bytesquality/B-correctness/B26-update-dependents-on-lifecycle-change.mddoc · 2,159 bytesquality/B-correctness/B27-change-a-child-row-through-its-parent.mddoc · 1,701 bytesquality/B-correctness/B28-orm-bypass-runs-no-validation.mddoc · 1,979 bytesquality/B-correctness/B29-persist-a-change-made-after-the-write-step.mddoc · 1,814 bytesquality/B-correctness/B31-no-request-state-in-lifecycle-code.mddoc · 1,984 bytesquality/B-correctness/B32-no-dependence-on-handler-order.mddoc · 2,173 bytesquality/B-correctness/B33-use-a-lifecycle-name-the-framework-calls.mddoc · 2,162 bytesquality/B-correctness/B34-validate-an-update-after-submit.mddoc · 2,129 bytesquality/B-correctness/B35-validate-in-every-path.mddoc · 2,249 bytesquality/B-correctness/B36-filter-submittable-doctypes-by-docstatus.mddoc · 1,974 bytesquality/B-correctness/B37-ordered-queries-need-a-tie-breaker.mddoc · 1,994 bytesquality/B-correctness/B40-optional-step-must-not-fail-the-flow.mddoc · 2,397 bytesquality/B-correctness/B42-templates-render-with-missing-data.mddoc · 1,891 bytesquality/B-correctness/B43-clear-the-document-cache-after-a-raw-write.mddoc · 2,096 bytesquality/B-correctness/B44-no-site-state-at-module-scope.mddoc · 2,521 bytesquality/B-correctness/B45-refresh-the-field-after-code-changes-it.mddoc · 2,148 bytesquality/_conventions.mddoc · 9,635 bytesquality/checks/K01-override-duplicates-core-method.mddoc · 5,364 bytesquality/checks/K02-framework-surface-breakage.mddoc · 17,060 bytesquality/mechanisms/M01-hooks-merge.mddoc · 2,533 bytesquality/mechanisms/M02-install-and-uninstall-hooks.mddoc · 3,418 bytesquality/mechanisms/M03-enable-and-disable-hooks.mddoc · 2,440 bytesquality/mechanisms/M04-migrate-hooks-and-patches.mddoc · 3,176 bytesquality/mechanisms/M05-build-hooks.mddoc · 1,598 bytesquality/mechanisms/M06-before-tests.mddoc · 1,675 bytesquality/mechanisms/M07-request-hooks.mddoc · 2,141 bytesquality/mechanisms/M08-job-hooks.mddoc · 2,182 bytesquality/mechanisms/M09-session-hooks.mddoc · 2,010 bytesquality/mechanisms/M10-controller-class.mddoc · 2,344 bytesquality/mechanisms/M11-document-lifecycle.mddoc · 4,617 bytesquality/mechanisms/M12-doc-events.mddoc · 3,047 bytesquality/mechanisms/M13-override-doctype-class.mddoc · 2,710 bytesquality/mechanisms/M14-extend-doctype-class.mddoc · 2,349 bytesquality/mechanisms/M15-virtual-doctype.mddoc · 3,092 bytesquality/mechanisms/M16-custom-doctype.mddoc · 2,331 bytesquality/mechanisms/M17-override-whitelisted-methods.mddoc · 2,794 bytesquality/mechanisms/M18-custom-field.mddoc · 3,521 bytesquality/mechanisms/M19-property-setter.mddoc · 2,851 bytesquality/mechanisms/M20-customize-form.mddoc · 2,791 bytesquality/mechanisms/M21-custom-folder-sync.mddoc · 3,067 bytesquality/mechanisms/M22-fixtures.mddoc · 2,431 bytesquality/mechanisms/M23-importable-doctypes.mddoc · 1,421 bytesquality/mechanisms/M24-client-script.mddoc · 2,248 bytesquality/mechanisms/M25-server-script.mddoc · 2,543 bytesquality/mechanisms/M26-doctype-layout.mddoc · 1,586 bytesquality/mechanisms/M27-naming.mddoc · 2,248 bytesquality/mechanisms/M28-workflow-methods.mddoc · 2,468 bytesquality/mechanisms/M29-data-driven-event-consumers.mddoc · 2,281 bytesquality/mechanisms/M30-link-check-exemptions.mddoc · 1,986 bytesquality/mechanisms/M31-dashboard-data.mddoc · 1,669 bytesquality/mechanisms/M32-timeline.mddoc · 1,804 bytesquality/mechanisms/M33-link-search.mddoc · 2,385 bytesquality/mechanisms/M34-has-permission-hook.mddoc · 2,262 bytesquality/mechanisms/M35-permission-query-conditions.mddoc · 2,511 bytesquality/mechanisms/M36-website-permission.mddoc · 2,156 bytesquality/mechanisms/M37-desk-js-files.mddoc · 2,328 bytesquality/mechanisms/M38-doctype-js-hooks.mddoc · 2,191 bytesquality/mechanisms/M39-form-event-handlers.mddoc · 2,441 bytesquality/mechanisms/M40-list-calendar-tree-settings.mddoc · 2,130 bytesquality/mechanisms/M41-formatters.mddoc · 1,902 bytesquality/mechanisms/M42-report-code.mddoc · 2,058 bytesquality/mechanisms/M43-dashboard-chart-source.mddoc · 1,981 bytesquality/mechanisms/M44-boot-hooks.mddoc · 2,432 bytesquality/mechanisms/M45-app-identity-and-navigation.mddoc · 2,382 bytesquality/mechanisms/M46-setup-wizard-hooks.mddoc · 2,574 bytesquality/mechanisms/M47-jinja.mddoc · 2,667 bytesquality/mechanisms/M48-print.mddoc · 2,823 bytesquality/mechanisms/M49-email-and-sms.mddoc · 2,600 bytesquality/mechanisms/M50-website-routing.mddoc · 2,977 bytesquality/mechanisms/M51-website-context-and-portal.mddoc · 3,110 bytesquality/mechanisms/M52-website-controllers.mddoc · 2,475 bytesquality/mechanisms/M53-assets.mddoc · 1,778 bytesquality/mechanisms/M54-scheduler.mddoc · 2,414 bytesquality/mechanisms/M55-cache-hooks.mddoc · 1,766 bytesquality/mechanisms/M56-file-hooks.mddoc · 2,115 bytesquality/mechanisms/M57-data-and-logs.mddoc · 2,708 bytesquality/mechanisms/M58-monkeypatching.mddoc · 2,184 bytesscripts/build_inventory.pyruns · 50,862 bytesscripts/run_audit.pyruns · 25,919 bytessecurity/A-authorization/A01-whitelist-authorization.mddoc · 2,497 bytessecurity/A-authorization/A02-idor-bola.mddoc · 1,936 bytessecurity/A-authorization/A03-client-settable-permission-bypass.mddoc · 1,102 bytessecurity/A-authorization/A04-guest-endpoints-and-rate-limits.mddoc · 2,382 bytessecurity/A-authorization/A05-role-permission-model.mddoc · 2,624 bytessecurity/A-authorization/A06-permission-query-and-hooks.mddoc · 2,233 bytessecurity/A-authorization/A07-child-table-and-linked-fields.mddoc · 1,455 bytessecurity/A-authorization/A08-privilege-escalation.mddoc · 1,045 bytessecurity/A-authorization/A09-rest-api-parity.mddoc · 1,043 bytessecurity/A-authorization/A10-realtime-socketio.mddoc · 1,072 bytessecurity/A-authorization/A11-share-assign-follow.mddoc · 1,055 bytessecurity/A-authorization/A12-webform-portal-webview.mddoc · 1,041 bytessecurity/A-authorization/A13-reports-authorization.mddoc · 1,143 bytessecurity/A-authorization/A14-doc-method-write-gate.mddoc · 2,717 bytessecurity/B-injection/B01-sql-injection.mddoc · 3,998 bytessecurity/B-injection/B02-untyped-orm-parameters.mddoc · 2,802 bytessecurity/B-injection/B03-query-builder-misuse.mddoc · 2,210 bytessecurity/B-injection/B04-multistatement-and-file-primitives.mddoc · 1,035 bytessecurity/B-injection/B05-ssti-jinja-templates.mddoc · 1,214 bytessecurity/B-injection/B06-jinja-sandbox-and-globals.mddoc · 1,554 bytessecurity/B-injection/B07-safe-exec-sandbox.mddoc · 1,462 bytessecurity/B-injection/B08-command-shell-injection.mddoc · 985 bytessecurity/B-injection/B09-dynamic-dispatch.mddoc · 1,145 bytessecurity/B-injection/B10-header-log-ldap-redis-deserialization.mddoc · 1,683 bytessecurity/C-xss-client/C01-stored-xss-document-fields.mddoc · 1,127 bytessecurity/C-xss-client/C02-unsafe-html-sinks.mddoc · 2,176 bytessecurity/C-xss-client/C03-sanitizer-bypasses.mddoc · 1,054 bytessecurity/C-xss-client/C04-iframes-svg-served-html.mddoc · 939 bytessecurity/C-xss-client/C05-csrf.mddoc · 1,002 bytessecurity/D-auth-identity/D01-session-handling.mddoc · 1,085 bytessecurity/D-auth-identity/D02-password-reset.mddoc · 1,106 bytessecurity/D-auth-identity/D03-two-factor.mddoc · 1,142 bytessecurity/D-auth-identity/D04-oauth-sso.mddoc · 1,128 bytessecurity/D-auth-identity/D05-user-enumeration-oracles.mddoc · 1,101 bytessecurity/D-auth-identity/D06-hmac-signed-urls.mddoc · 1,104 bytessecurity/D-auth-identity/D07-api-keys-tokens.mddoc · 963 bytessecurity/D-auth-identity/D08-impersonation-set-user.mddoc · 1,063 bytessecurity/E-files-paths/E01-path-traversal.mddoc · 2,325 bytessecurity/E-files-paths/E02-upload-validation.mddoc · 1,067 bytessecurity/E-files-paths/E03-file-privacy-and-permissions.mddoc · 1,123 bytessecurity/E-files-paths/E04-static-file-serving.mddoc · 1,070 bytessecurity/F-ssrf-outbound/F01-ssrf.mddoc · 2,158 bytessecurity/F-ssrf-outbound/F02-header-trust.mddoc · 1,095 bytessecurity/F-ssrf-outbound/F03-open-redirect.mddoc · 986 bytessecurity/G-crypto-secrets/G01-secret-storage.mddoc · 1,406 bytessecurity/G-crypto-secrets/G02-secrets-in-logs-and-responses.mddoc · 1,063 bytessecurity/G-crypto-secrets/G03-weak-randomness.mddoc · 851 bytessecurity/G-crypto-secrets/G04-crypto-primitives.mddoc · 868 bytessecurity/H-business-logic/H01-mass-assignment.mddoc · 1,137 bytessecurity/H-business-logic/H02-workflow-docstatus-bypass.mddoc · 1,111 bytessecurity/H-business-logic/H03-financial-validation.mddoc · 1,074 bytessecurity/H-business-logic/H04-race-conditions.mddoc · 991 bytessecurity/H-business-logic/H05-tenant-company-scoping.mddoc · 1,021 bytessecurity/I-info-disclosure/I01-over-fetching-endpoints.mddoc · 1,975 bytessecurity/I-info-disclosure/I02-metadata-leaks.mddoc · 2,022 bytessecurity/I-info-disclosure/I03-search-leaks.mddoc · 990 bytessecurity/I-info-disclosure/I04-pii-exposure.mddoc · 1,025 bytessecurity/J-email-messaging/J01-recipient-control-and-spoofing.mddoc · 1,000 bytessecurity/J-email-messaging/J02-inbound-email-trust.mddoc · 1,129 bytessecurity/J-email-messaging/J03-communication-permission.mddoc · 1,038 bytessecurity/K-dos-abuse/K01-resource-exhaustion.mddoc · 1,373 bytessecurity/K-dos-abuse/K02-job-and-scheduler-abuse.mddoc · 921 bytessecurity/L-supply-chain/L01-python-dependencies.mddoc · 984 bytessecurity/L-supply-chain/L02-js-dependencies.mddoc · 1,312 bytessecurity/_conventions.mddoc · 15,782 bytessecurity/_framework-guards.mddoc · 15,451 bytessecurity/checks/P01-endpoint-hardening-coverage.mddoc · 1,849 bytessecurity/checks/P02-invariant-diffs.mddoc · 3,228 bytessecurity/checks/P03-security-headers.mddoc · 1,193 bytessecurity/checks/P04-dependency-pinning-integrity.mddoc · 1,047 bytessecurity/checks/P05-ci-cd-and-repo-hygiene.mddoc · 1,325 bytes
No licensed excerpt is available. You can inspect the pinned source.