audit-security

Analyze recent repository changes for security vulnerabilities and OWASP risks.

1|Updated Mar 20, 2026
One-click install
npx skills add https://github.com/hirokimry/vibecorp --skill audit-security-hirokimry
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: audit-security
Source: https://github.com/hirokimry/vibecorp/tree/main/skills/audit-security
Command: npx skills add https://github.com/hirokimry/vibecorp --skill audit-security-hirokimry

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill automates monthly security review work for a codebase, helping teams detect risky changes, document findings, and escalate serious issues without manual report assembly.

Core Features & Use Cases

  • Recent-change analysis: Reviews the last 30 days of repository activity for authentication, authorization, dependency, hook, and secret-handling changes.
  • Structured reporting: Appends findings to quarterly security audit logs and updates an index for traceability.
  • Escalation workflow: Opens issues when Critical or Major findings are detected, while leaving Minor findings as report-only items.
  • Use case: A team wants a repeatable monthly CISO-style audit that preserves knowledge, enforces safety gates, and produces an actionable security summary.

Quick Start

Ask the skill to run a monthly security audit for the last 30 days, save the report to the security log, and create an issue if serious findings are discovered.

Frequently Asked Questions about audit-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate monthly security audits for recent GitHub repository changes?

Automate monthly security audits by analyzing the last 30 days of repository activity to identify authentication, dependency, and OWASP-relevant risks. The skill reviews recent changes, classifies severity, and appends findings to quarterly security logs automatically.

What is the process for escalating Critical or Major security vulnerabilities during an audit?

Escalating Critical or Major security vulnerabilities involves automatically opening GitHub issues when serious findings are detected during the audit. Minor findings remain report-only items within the structured quarterly security audit logs.

How does an automated security audit handle OWASP risk analysis and severity classification?

Automated security audit OWASP risk analysis evaluates repository changes for authorization, hook, and secret-handling vulnerabilities, then applies structured severity classification to categorize findings as Critical, Major, or Minor for appropriate escalation.

Do I need a configured CISO agent to run a vulnerability analysis on my codebase?

Yes, running vulnerability analysis requires the full preset, a configured CISO agent, and the security audit template. It enforces direct-write protection and controlled git operations while generating reports in a buffer worktree.

What are the limitations of automated issue triage for security findings?

Automated issue triage limitations include enforcing direct-write protection and controlled git operations to prevent unauthorized changes, restricting issue creation to only Critical or Major findings, and leaving Minor findings as report-only items.