skills.rest
Cogni-AI-OU
Cogni-AI-OUOFFICIAL
Explore all skills by this author ā†’
Websiteš•@Cogni_AI_OUGitHub

security-audit

Audit codebases for vulnerabilities, dependencies, secrets, and patch proposals.

3|1|Updated Apr 12, 2026
Search Tags:#vulnerability assessment#threat modeling#report generation#security audit#secrets detection#dependency scanning#patch proposals
One-click install
npx skills add https://github.com/Cogni-AI-OU/cogni-ai-agent-skills --skill security-audit-cogni-ai-ou
Or copy as Structured Prompt for Agentā–¼
Please help me install this Agent Skill.
Skill: security-audit
Source: https://github.com/Cogni-AI-OU/cogni-ai-agent-skills/tree/main/security-audit
Command: npx skills add https://github.com/Cogni-AI-OU/cogni-ai-agent-skills --skill security-audit-cogni-ai-ou

SYSTEM DOCUMENTATION & REQUIREMENTS

šŸ’” This Skill includes references (resource) components.

What problem does it solve?

This Skill solves the problem of performing thorough, repeatable security audits by combining dependency and secrets inspection with deep vulnerability review and structured reporting.

Core Features & Use Cases

  • End-to-end audit workflow: Resolve scope, then run dependency audit, secrets/exposure scanning, deep vulnerability checks, and cross-file data flow analysis.
  • Threat modeling with exploitability: Use STRIDE, blast-radius assessment, and exploit scenario formulation to determine real-world risk.
  • Patch-ready reporting: Produce a report using the standardized format in references/report-format.md, including patch proposals for CRITICAL/HIGH issues.

Quick Start

Run /security-audit on your repository path to generate a full security audit report covering vulnerabilities, dependency risk, secrets exposure, and remediation steps.

Frequently Asked Questions about security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security audit on my codebase to check for vulnerabilities and exposed secrets?ā–¼

To perform a security audit, the Skill executes an end-to-end workflow covering dependency auditing, secrets detection, and deep vulnerability checks with cross-file data flow analysis. It outputs a standardized, audit-ready report with findings summaries and patch proposals.

What is threat modeling and exploitability assessment in a code security audit?ā–¼

Threat modeling in a security audit applies STRIDE methodology and blast-radius assessment to formulate real-world exploit scenarios. This determines actual exploitability of vulnerabilities, moving beyond basic scanning to assess true real-world risk.

Can I use this security audit workflow for path-scoped repository checks?ā–¼

Yes, this security audit workflow supports path-scoped repository checks. It resolves audit scope automatically, allowing targeted directory or configuration scanning while still producing a deterministic, audit-ready report for engineering review.

Does dependency scanning include patch proposals for vulnerable packages?ā–¼

Dependency scanning includes patch proposals specifically for CRITICAL and HIGH severity vulnerabilities. The generated audit report matches remediation steps to finding severity, ensuring engineering teams receive actionable fixes for the most critical issues.

What is the best way to generate an audit-ready report for code vulnerabilities and remediation planning?ā–¼

The best way to generate an audit-ready report for remediation planning is to use a deterministic format containing findings summaries, dependency and secrets sections, and severity-matched patch proposals. This structured output is designed directly for engineering review.

Related Skills

Explore More Software Engineering Skillsā†’
superfhpsuperfhp

codebase-inspection

Analyze codebases with pygount to calculate lines of code and language breakdowns.

Community
Intermediate
diShine-digital-agencydiShine-digital-agency
1

shine-tag-audit

Validate GTM container JSON exports with 14 governance, consent, and security checks.

Community
Intermediate
voidrotvoidrot

sast-configuration

Configure SAST tools like Semgrep, CodeQL, and SonarQube for CI/CD pipelines.

Community
Intermediate
CENKSSSCENKSSS

pentest-validation

Validate SAST and DAST vulnerability exploitability through a 4-phase pipeline.

Community
Advanced