AI Prompt Card
Grok BotWorkflowInstruction template

Codebase Hardening & Vulnerability Auditor

Audit a fast-shipped codebase against 20 fixed checks, recording file evidence, uninspected scope and proposed fixes without treating every style heuristic as a defect.

Create in Grok

0 opens · 0 copies

Source credit: botdirectory

Bot spec
Type
Workflow
Optional tools
GitHub
Delivery
Copyable instruction template
Updated
Sep 5, 2026

Setup and workflow

Use read-only repository access or a code snapshot at a known commit. Tests require an execution environment; a GitHub link is not execution evidence.

  1. Fix the commit and excluded directories, then read conventions and tests.
  2. Review evidence for all 20 checks and choose one reproducible finding for subsequent repair.

Input and output example

Illustrative example · not an execution result

Input

Demo: Only an order route is supplied. It calls a payment API without an idempotency key. Do not edit.

Output

Check 14: do not add retries immediately; first inspect payment idempotency to avoid duplicate charges. Checks needing whole-repository evidence remain uninspected. Return recommendations, not a claim that all 20 checks passed.

Limits and failure cases

  • Static review does not replace penetration testing or prove the absence of vulnerabilities.
  • Inaccessible directories and unexecuted tests remain uninspected.

What was verified

Source check · Verified · 2026-09-05
Compared with bots/codebase-hardening-auditor.md in BotDirectory commit 84dc42af7661. This checks the published entry (prompt or description), not its execution or every original social post.
Prompt rehearsal · Not verified
Editorial review and an illustrative example only; no independent model execution was recorded.
Native Grok execution · Not verified
Native Grok execution, tool permissions and real account operations have not been tested.
Bot link access · Not applicable
This entry is a copyable instruction template, not a verified native Bot installation.

Source and editorial adaptation

Adapted from Codebase Hardening Auditor in botdirectory.ai (listed contributor: nate-stellar), distributed under MIT. Contributor credit is taken from that repository, not independently authenticated. AI Prompt Card supplies bilingual editing, usage notes and labelled examples. The source link records the upstream version; no endorsement is implied.

Source license and attribution
Bot instructions

Copyable instruction template

Instructions curated or adapted by this site, not a claim to reproduce the native Bot’s internal system prompt. Check setup, tools and limitations before use.

Audit hardening needs in the repository and branch I specify. Confirm commit, directory scope, test commands and read-only access first. Without repository access, request files and do not claim a whole-repository review. Work through these 20 checks: 1. Duplicate utilities; 2. secrets committed in config; 3. functions over 400 lines; 4. components over 200 lines; 5. dead code; 6. silent or empty catches; 7. missing loading/error UI; 8. queries inside route handlers; 9. synchronous request I/O; 10. unpaginated lists; 11. inconsistent response shapes; 12. floating-point money; 13. nonstandard date representations; 14. external calls without retry/backoff; 15. stale comments; 16. unvalidated input; 17. missing authorization; 18. missing indexes for frequent queries; 19. N+1 queries; 20. repeated SDK initialization. For every check, record inspected scope, file/line evidence, trigger and recommendation. Use “not inspected” when access or evidence is missing, and “none found within scope” only after inspection. Length thresholds, route organization, dates and retries are contextual signals; evaluate project conventions. Report redacted secret locations, never secret values. Finish with a 20-row status table, priorities and proposed verification. Do not edit code or open PRs by default. Present a specific diff and obtain approval before implementation. Preserve uncommitted changes and do not perform destructive cleanup.
Create in Grok

0 opens · 0 copies

Editorial assessment

Useful when a prototype enters sustained maintenance. This edition aligns the previously inconsistent bilingual checklists. Function length, route-level queries and retries are contextual signals, not automatic defects; blindly retrying non-idempotent calls can be worse than no retry. The audit is read-only until a fix is approved.

This directory is an independent, fan-made catalog. It is not affiliated with, endorsed by, or sponsored by xAI or Grok. Grok and related names are trademarks of their respective owners. Live-bot links point to official x.ai pages.

More Grok bots

Related bot prompts

Workflow

Release Notes Page

Turn a defined range of pull requests or commits into user-facing release notes with traceable evidence, plus a reviewable stable-page update and notification draft.

Create in Grok
0 opens · 0 copies
Workflow

New Hire Ramp Plan

Plan first-week introductions, reading and a small verifiable deliverable from role goals and authorized onboarding examples, without automatically scheduling meetings.

Create in Grok
0 opens · 0 copies
Research

Competitive Build Researcher

Translate public evidence about named competitors into build trade-offs and an implementation plan, separating observed behavior, technical inference and unvalidated demand.

Create in Grok
0 opens · 0 copies