security-audit

Audit codebases against OWASP Top 10 and generate security reports.

Updated Mar 18, 2026
One-click install
npx skills add https://github.com/dr-code/beacon --skill security-audit-dr-code
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-audit
Source: https://github.com/dr-code/beacon/tree/main/plugins/agent-triforce/skills/security-audit
Command: npx skills add https://github.com/dr-code/beacon --skill security-audit-dr-code

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Deep security audit covering OWASP Top 10, authentication, authorization, data protection, dependency vulnerabilities, and secrets scanning. Delegates to the Centinela (QA) agent.

Core Features & Use Cases

  • Runs the SIGN IN checklist
  • Performs OWASP Top 10 systematic check (A01-A10)
  • Scans for hardcoded secrets, API keys, tokens, and connection strings
  • Audits dependencies for known CVEs
  • Checks smart contracts if Solidity is present (reentrancy, overflow, access control)
  • Runs Security Verification and Quality Verification checklists (TIME OUT)
  • Issues verdict and writes report to docs/reviews/security-audit-{date}.md
  • Prepares findings handoff to Dev agent

Quick Start

Run a full security audit with /security-audit to cover the entire codebase.

Frequently Asked Questions about security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform an OWASP Top 10 security audit on my codebase?▼

Run a comprehensive security audit to systematically check your codebase against OWASP Top 10 categories A01-A10, identifying and mitigating risks across authentication, data handling, and dependencies.

How do I scan my project for hardcoded secrets and API keys?▼

Scan your project for hardcoded secrets by running an audit that checks codebases for embedded API keys, tokens, and connection strings, generating a report of exposed credentials for remediation.

Can I check my project dependencies for known CVE vulnerabilities?▼

Yes, you can check project dependencies for known CVE vulnerabilities. The audit process scans dependencies to identify known security flaws and includes them in the final security report.

Does the security audit cover smart contract vulnerabilities like reentrancy?▼

Yes, the security audit covers smart contract vulnerabilities if Solidity is present, specifically checking for reentrancy, overflow issues, and access control problems within the codebase.

How do I generate a security audit report for my software release?▼

Generate a security audit report by running a full audit, which issues a verdict and writes the findings to docs/reviews/security-audit-{date}.md, preparing a handoff to the Dev agent.

What is included in a pre-release security check for software?▼

A pre-release security check includes running sign-in checklists, scanning for hardcoded secrets, auditing dependencies for CVEs, and verifying OWASP Top 10 compliance to ensure software security.