security-audit

Audits a repository for vulnerabilities, gitignore issues, and compliance.

Updated Mar 30, 2026
One-click install
npx skills add https://github.com/Eric-Pacheco95/claude-workbench --skill security-audit-eric-pacheco95
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: security-audit
Source: https://github.com/Eric-Pacheco95/claude-workbench/tree/main/.claude/skills/security-audit
Command: npx skills add https://github.com/Eric-Pacheco95/claude-workbench --skill security-audit-eric-pacheco95

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill performs a thorough security audit on your repository, identifying and addressing potential vulnerabilities and non-compliance issues.

Core Features & Use Cases

  • Comprehensive Security Scanning: Checks for exposed secrets, gitignore gaps, configuration weaknesses, prompt-injection surfaces, and constitutional compliance violations.
  • LLM-Powered Triage: Utilizes an AI model to assess severity, filter false positives, and suggest remediation steps.
  • Customizable Scopes: Audit specific areas like secrets, pre-commit, gitignore, constitutional compliance, or a full audit.
  • Audit Reporting: Generates a detailed report with severity ratings, remediation steps, and a summary of findings.

Quick Start

Run a full security audit on your repository with the command: /security-audit

Frequently Asked Questions about security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security audit on my repository to find exposed secrets?

To run a security audit on your repository, use an AI-driven tool that scans for exposed secrets, gitignore gaps, and configuration weaknesses. It evaluates vulnerabilities, filters false positives, and generates a detailed remediation report.

What is AI-driven PII detection and how does it work for repository security?

AI-driven PII detection scans repository files using a Python-based scanner to identify personally identifiable information. The AI model triages the findings to assess severity, filter false positives, and suggest remediation steps for compliance.

Can I scan only specific areas like gitignore issues and constitutional compliance?

Yes, you can customize the security audit scope to target specific areas like secrets, pre-commit configurations, gitignore issues, constitutional compliance, or run a full audit across all dimensions.

Does repository security scanning require Python to run the PII scanner?

Yes, Python is required to run the PII scanner and other security auditing tools. The AI-driven audit relies on Python scripts to identify vulnerabilities, evaluate compliance, and generate the final report.

What is the best way to check my repository for prompt-injection surfaces?

The best way to check for prompt-injection surfaces is using an LLM-powered security audit. It comprehensively scans for configuration weaknesses and prompt-injection surfaces, utilizing AI to triage severity and suggest remediation.

What limitations should I expect when using an LLM-powered security audit?

An LLM-powered security audit relies on Python and AI triage to filter false positives, but limitations include potential missed vulnerabilities in complex configurations and the need for manual review of constitutional compliance findings.