Match the project to your task before installing it.
Security Review & Permission Governance · Public
vorim-agent-audit
Free AI agent code hygiene checker. Scans for hardcoded LLM keys, shared credentials, and long-lived permissions in TypeScript, JavaScript, and Python projects. By Vorim AI.
Best fitUsers who want source-backed project understanding before installing it.
Check whether this project matches your task before installing it.
What it can doskill, recipe, host_instruction, eval, preflightReview the portable capability path.
Before continuingVerify in a sandboxDo not treat a preview pack as a proven local install.
GitHub snapshot1 stars0 forks · 2 contributors
Doramagic.ai Last verification date: 2026-07-27 Verification method: source evidence, semantic profile, public page gate, and static build acceptance.
Publication status · 2026-07-27
What is vorim-agent-audit?
- Free AI agent code hygiene checker. Scans for hardcoded LLM keys, shared credentials, and long-lived permissions in TypeScript, JavaScript, and Python projects. By Vorim AI.
- Best fit: Users who want source-backed project understanding before installing it.
- Not for: Not for users who want to skip sandbox verification or cannot accept configuration, permission, or maintenance overhead.
- Capability added to an AI workflow: skill, recipe, host_instruction, eval, preflight
- First safe verification step: Verify the smallest path in an isolated environment and keep a rollback path.
- Verification state: source, Quick Start, and sandbox install checks are recorded as passed.
- Top risk: May increase setup, validation, or first-run risk for the user.
- Evidence base: https://github.com/Vorim-AI-Labs/vorim-agent-audit, https://github.com/Vorim-AI-Labs/vorim-agent-audit#readme, Human Manual, Pitfall Log
01
Quick decision
Use this section to decide whether the project is worth a deeper read.Free AI agent code hygiene checker. Scans for hardcoded LLM keys, shared credentials, and long-lived permissions in TypeScript, JavaScript, and Python projects. By Vorim AI.
1 stars · 0 forks
02
What it can do
Translate the upstream project into concrete capabilities the user can judge before installing.Introduction and Installation
Related topics: Architecture and Scanning Pipeline, CLI Options, Output, and CI Integration
Source: https://github.com/Vorim-AI-Labs/vorim-agent-audit / Human Manual
Architecture and Scanning Pipeline
Related topics: Detection Rules and Pattern Catalogue, CLI Options, Output, and CI Integration
Source: https://github.com/Vorim-AI-Labs/vorim-agent-audit / Human Manual
Detection Rules and Pattern Catalogue
Related topics: Architecture and Scanning Pipeline, CLI Options, Output, and CI Integration
Source: https://github.com/Vorim-AI-Labs/vorim-agent-audit / Human Manual
CLI Options, Output, and CI Integration
Related topics: Introduction and Installation, Architecture and Scanning Pipeline
Source: https://github.com/Vorim-AI-Labs/vorim-agent-audit / Human Manual
Doramagic Pitfall Log
Source-linked risks stay visible on the manual page so the preview does not read like a recommendation.
Source: Doramagic discovery, validation, and Project Pack records
Sources: https://github.com/Vorim-AI-Labs/vorim-agent-audit, Human Manual, Project Pack evidence, and downstream validation signals.
03
Community Discussion Evidence
Project-level external discussion stays visible on the detail page, not only inside the manual.Community Discussion Evidence
2 source-linked itemsReview these external discussions before using vorim-agent-audit with real data or production workflows. They are review inputs, not standalone proof that the project is production-ready.
-
01
v0.1.0 — Initial release
github / github_release
-
02
Identity risk requires verification
GitHub / issue
04
How to start
Only source-backed commands are shown here. Verify them in an isolated environment first.Try the prompt first
Test the workflow without installing the upstream project.
previewRead the Human Manual
Understand inputs, outputs, limits, and failure modes.
manualTake context to your AI host
Use the compiled assets in your preferred AI environment.
contextRun sandbox verification
Confirm install commands and rollback before using a primary environment.
verifynpx @vorim/agent-auditOfficial start command · https://github.com/Vorim-AI-Labs/vorim-agent-audit#readme · verified: yes
05
Human Manual
The English page must expose the real manual, not a short placeholder.8+ sections · Human Manual
vorim-agent-audit Manual
The detection layer is organised as a thin dispatcher around a shared pattern registry. Patterns (regexes, string templates, and helper matchers) live in src/patterns.ts so that several ru...
Open the full manual- https://github.com/Vorim-AI-Labs/vorim-agent-audit Project Manual
- Table of Contents
- Introduction and Installation
- Related Pages
- What Is vorim-agent-audit
- Scope of Checks
- Installation
- First Run and Workflow
Introduction and Installation
Related topics: Architecture and Scanning Pipeline, CLI Options, Output, and CI Integration
Source: https://github.com/Vorim-AI-Labs/vorim-agent-audit / Human Manual
Architecture and Scanning Pipeline
Related topics: Detection Rules and Pattern Catalogue, CLI Options, Output, and CI Integration
Source: https://github.com/Vorim-AI-Labs/vorim-agent-audit / Human Manual
Detection Rules and Pattern Catalogue
Related topics: Architecture and Scanning Pipeline, CLI Options, Output, and CI Integration
Source: https://github.com/Vorim-AI-Labs/vorim-agent-audit / Human Manual
CLI Options, Output, and CI Integration
Related topics: Introduction and Installation, Architecture and Scanning Pipeline
Source: https://github.com/Vorim-AI-Labs/vorim-agent-audit / Human Manual
Doramagic Pitfall Log
Source-linked risks stay visible on the manual page so the preview does not read like a recommendation.
Source: Doramagic discovery, validation, and Project Pack records
06
AI Context Pack and portable assets
After deciding to continue, take the project context into your own AI host.Complete pack plus user-owned assets
These files are planning and verification assets for Claude Code, Codex, Gemini, Cursor, ChatGPT, and other AI hosts.
07
Preflight checks
Treat this page as a planning asset, not proof that your local environment is ready.- The manual is generated from source-linked project files and Doramagic validation signals.
- Community evidence warnings stay visible instead of being converted into marketing claims.
- This English page is indexable because the locale quality gate passed and explicit English index approval is enabled.
- Use the upstream repository as the final authority for installation commands, license, and version-specific behavior.
08
Pitfall Log and verification risks
Doramagic surfaces high-risk items before users treat a candidate capability as verified.Identity risk requires verification
May increase setup, validation, or first-run risk for the user.
Capability evidence risk requires verification
May increase setup, validation, or first-run risk for the user.
Maintenance risk requires verification
May increase setup, validation, or first-run risk for the user.
Security or permission risk requires verification
May increase setup, validation, or first-run risk for the user.
Security or permission risk requires verification
May increase setup, validation, or first-run risk for the user.
Maintenance risk requires verification
May increase setup, validation, or first-run risk for the user.
Maintenance risk requires verification
May increase setup, validation, or first-run risk for the user.