1-security-audit

Scan codebases for vulnerabilities and generate a SECURITY_PLAN.md.

1|Updated Feb 10, 2026
One-click install
npx skills add https://github.com/opsMachine/OM-Agency --skill 1-security-audit
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: 1-security-audit
Source: https://github.com/opsMachine/OM-Agency/tree/main/skills/1-security-audit
Command: npx skills add https://github.com/opsMachine/OM-Agency --skill 1-security-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security reviews are manual and error-prone; Phase 1 automates vulnerability discovery and centralizes remediation guidance by generating a SECURITY_PLAN.md at the project root.

Core Features & Use Cases

  • Automated discovery of common vulnerabilities: insecure endpoints, missing input validation, authorization gaps, and exposed secrets in code.
  • Generates a centralized SECURITY_PLAN.md that prioritizes findings by severity and location.
  • Integrates with the broader four-phase security pipeline and can be invoked directly or after full-security-audit, enabling seamless workflow transitions.

Quick Start

Run the Phase 1 security audit on your project to generate SECURITY_PLAN.md.

Frequently Asked Questions about 1-security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate a security audit to find vulnerabilities in my codebase?

A security audit automates vulnerability discovery by scanning source folders like src/app and API directories to identify insecure endpoints, missing input validation, authorization gaps, and exposed secrets. It then generates a prioritized remediation plan.

What is a SECURITY_PLAN.md and how does it help with code vulnerability scanning?

A SECURITY_PLAN.md is a centralized file generated at the project root during a security audit. It lists discovered code vulnerabilities prioritized by severity and location, providing structured remediation guidance for the development team.

Can I run a security audit on specific API directories and source folders?

Yes, the security audit analyzes specified source folders such as src/app or API directories. It scans these locations for mutable endpoints, missing validation, and exposed secrets, then outputs findings with severity and precise locations.

How do I start a security review pipeline for a software project?

You can kickstart a security review pipeline by running a Phase 1 security audit directly on your software project. This initial scan discovers common vulnerabilities and generates a SECURITY_PLAN.md to centralize and guide remediation efforts.

What types of security gaps can automated code scanning detect?

Automated code scanning detects common security gaps including insecure endpoints, missing input validation, authorization gaps, and exposed secrets. It analyzes the codebase to output these findings with corresponding severity levels and locations.

What's the best way to centralize remediation guidance after discovering code vulnerabilities?

The best way to centralize remediation guidance is to generate a SECURITY_PLAN.md at the project root. This file prioritizes discovered vulnerabilities by severity and location, replacing manual and error-prone security review processes.