skills.rest
porcupine-md
porcupine-mdOFFICIAL
Explore all skills by this author →
GitHub

auditing-security

Identify infrastructure security risks in application deployments using OWASP and STRIDE frameworks.

11|2|Updated Apr 7, 2026
Search Tags:#security#owasp#dependencies#audit#compliance#secrets#threat-modeling
One-click install
npx skills add https://github.com/porcupine-md/jonggrang --skill auditing-security-porcupine-md
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: auditing-security
Source: https://github.com/porcupine-md/jonggrang/tree/main/skills/library/security/auditing-security
Command: npx skills add https://github.com/porcupine-md/jonggrang --skill auditing-security-porcupine-md

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Teams building and maintaining software deploy insecure systems due to unnoticed configuration flaws, secrets exposure, and supply-chain risks. This Skill provides a structured, read-only audit workflow focused on infrastructure and deployment security without modifying source code.

Core Features & Use Cases

  • Information gathering and risk assessment: Use glob to locate target files under .jonggrang/.output/features/ and read/grep to detect secrets, misconfigurations, and insecure dependencies, all in a read-only manner.
  • Threat modeling and risk prioritization: Apply OWASP Top 10 and STRIDE frameworks to categorize findings by severity and potential impact.
  • Auditing output and remediation guidance: Compile actionable findings and save a scoped report to the designated audit path for review and compliance evidence.

Quick Start

Run the security audit workflow against the active feature to generate the audit report.

Frequently Asked Questions about auditing-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit application deployments for infrastructure security risks?▼

You can audit application deployments for infrastructure security risks by running a read-only workflow that scans codebases, deployment configurations, modules, and pipelines to detect misconfigurations, secrets exposure, and insecure dependencies.

What is the best way to categorize security threats found in my deployment configurations?▼

The best way to categorize security threats in deployment configurations is by applying OWASP Top 10 and STRIDE frameworks, which structure findings by severity and potential impact for prioritized remediation.

How do I detect exposed secrets and insecure dependencies without modifying source code?▼

You can detect exposed secrets and insecure dependencies without modifying source code by using a read-only information gathering process that locates target files with glob and reads them with grep to identify risks.

Can I generate a compliance report for security audits across my project modules?▼

Yes, you can generate a compliance report for security audits across modules by compiling actionable findings and threat modeling results into a structured markdown audit report saved to the designated output directory.

Does the security audit workflow support threat modeling for supply-chain risks?▼

Yes, the security audit workflow supports threat modeling for supply-chain risks by assessing insecure dependencies and deployment configurations using structured analysis with STRIDE and OWASP frameworks.

Related Skills

Explore More Legal & Compliance Skills→
gioegioe

investigate-directory

Audit a directory's content and structure to infer its purpose and quality signals.

Community
Intermediate
RedWoodOGRedWoodOG
174

security-audit

Scan codebases for secrets, vulnerable dependencies, and misconfigurations.

Community
Advanced
sadie100sadie100

cso

Audit infrastructure, applications, and development processes for security vulnerabilities.

Community
Advanced
froggugugugufroggugugugu

security-scan

Execute SCA, SAST, DAST, and secret detection scans to report vulnerabilities.

Community
Advanced