Scan codebases for security vulnerabilities and generate a prioritized remediation plan.
npx skills add https://github.com/tomzx/agents --skill audit-security-tomzx
Please help me install this Agent Skill. Skill: audit-security Source: https://github.com/tomzx/agents/tree/main/skills/audit-security Command: npx skills add https://github.com/tomzx/agents --skill audit-security-tomzx
Scan codebases to identify code-level security vulnerabilities such as hardcoded secrets, injection risks, missing authentication/authorization checks, and insecure patterns, then produce a prioritized remediation plan.
Run the audit-security scan from the repository root to identify vulnerabilities and generate a remediation plan.
High-intent search queries and answers about installing and using this skill.
Scan codebases for hardcoded secrets and vulnerabilities by running an audit from the repository root. It identifies injection risks, committed credentials, and insecure patterns, then outputs a severity-ranked remediation plan to fix issues efficiently.
A severity-ranked remediation plan for code security risks prioritizes identified vulnerabilities by impact, helping developers fix injection flaws, missing auth checks, and hardcoded secrets efficiently during periodic code audits or CI gates.
Yes, running a code security audit requires scanners like semgrep, bandit, or gosec, or grep-based heuristics. These tools detect language-agnostic vulnerabilities and insecure patterns across codebases to generate the remediation plan.
Yes, you can use static analysis to find insecure code patterns in CI gates and pre-merge checks. The audit identifies missing authorization, injection risks, and misconfigurations to ensure ongoing security hygiene before merging.
The best way to detect broken authentication and insecure deserialization is running a comprehensive code audit using semgrep or gosec. It spots these vulnerability risks alongside misconfigurations and generates prioritized remediation steps.
Static analysis during a code audit may miss vulnerabilities if configured scanners lack rules for specific insecure patterns or custom authentication logic. Combining tools like semgrep, bandit, and grep-based heuristics improves detection coverage.
florianbuetowScan code and dependencies for vulnerabilities mapped to CWEs.
maddhruvScan codebases for security vulnerabilities in dependencies and code.
armanzeroeightDetect hardcoded secrets and API keys in source code repositories.
Ed1s0nZAnalyze Android and iOS applications for security vulnerabilities using static and dynamic techniques.
