codebase-security-audit

Audit codebases with secrets scanning, SAST, SCA, and IaC validation.

15|2|Updated Dec 13, 2025

Search Tags:#ci/cd #security audit #sast #owasp top 10 #sca #secrets scanning #remediation plan

Ready to run

npx skills add https://github.com/d-padmanabhan/agent-engineering-handbook --skill codebase-security-audit

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: codebase-security-audit
Source: https://github.com/d-padmanabhan/agent-engineering-handbook/tree/main/skills/codebase-security-audit
Command: npx skills add https://github.com/d-padmanabhan/agent-engineering-handbook --skill codebase-security-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It eliminates security blind spots by running an end-to-end codebase review that finds secrets, vulnerable dependencies, injection paths, and infrastructure misconfigurations—then turns results into a prioritized remediation plan.

Core Features & Use Cases

Eight-layer security coverage across Secrets, SAST, SCA, data-flow/taint, semantic/CPG, IaC, Custom rules, and DAST to make gaps explicit.
Actionable remediation outputs including severity-ranked findings, .env templates, and a ready-to-use CI/CD continuous scanning approach.
OWASP Top 10 (2021) focused checks with curated ripgrep playbooks per category to accelerate triage and fixes.

Quick Start

Use the skill to perform a full audit by telling your AI agent: "Run a security audit of this repository using the eight-layer model, map findings to OWASP Top 10, and generate a severity-ranked remediation plan plus CI/CD scanning workflow."

Frequently Asked Questions about codebase-security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform an end-to-end security audit on a codebase to check for the OWASP Top 10?▼

To find committed secrets, run secrets scanning alongside SAST and SCA checks. This skill executes these scans to locate exposed credentials and provides a prioritized remediation plan to secure the repository.

What is the best way to set up continuous vulnerability scanning in CI/CD for SAST and SCA?▼

Setting up continuous vulnerability scanning in CI/CD requires configuring automated gates for SAST, SCA, secrets, and IaC. This skill generates a ready-to-use CI/CD workflow to continuously run these critical security checks.

How does data-flow taint analysis detect injection paths during a SAST evaluation?▼

Data-flow taint analysis tracks untrusted input through the codebase to identify potential injection paths. This skill incorporates this analysis layer alongside semantic checks to expose hidden vulnerabilities and rank them by severity.

Do I need specific tooling credentials to run an automated codebase security audit?▼

Running an automated codebase security audit often requires credentials for various scanning tools. This skill generates .env and setup templates to help you quickly configure the required tooling credentials for the audit.