skills.rest
gunning4it
gunning4itCOMMUNITY
Explore all skills by this author →
GitHub

security-audit

Audit JavaScript monorepos for security vulnerabilities, secret leakage, and dependency risks.

Updated Feb 8, 2026
Search Tags:#security#dependencies#audit#monorepo#secrets#policy#pr-review
One-click install
npx skills add https://github.com/gunning4it/openorder --skill security-audit-gunning4it
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-audit
Source: https://github.com/gunning4it/openorder/tree/main/.claude/skills/security-audit
Command: npx skills add https://github.com/gunning4it/openorder --skill security-audit-gunning4it

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Audit codebases for security vulnerabilities, secret leakage, dependency risks, and misconfigurations to prevent exposure before commits, PRs, or dependency updates.

Core Features & Use Cases

  • Detect hardcoded secrets and enforce zero-secrets policy.
  • Identify insecure dependencies, weak configurations, and build-time risks.
  • Provide actionable remediation guidance during pre-commit or PR reviews for monorepos.

Quick Start

Run a repository-wide security audit to identify secrets, vulnerable dependencies, and misconfigurations.

Frequently Asked Questions about security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a JavaScript monorepo for hardcoded secrets before committing?▼

You can scan for high-entropy keys across apps/ and packages/ directories to enforce a zero-secrets policy before commits. This detects exposed credentials and verifies .env files are ignored.

Can I check for vulnerable dependencies and unsafe scripts during a PR review?▼

You can validate lockfiles and flag unsafe scripts during PR reviews to identify insecure dependencies and enforce dependency isolation. This catches build-time risks and environment leakage before merging code.

What is dependency isolation and how does it prevent environment leakage in monorepos?▼

Dependency isolation prevents environment leakage by ensuring packages do not inadvertently expose insecure configurations or credentials. Auditing validates lockfiles and flags unsafe scripts to maintain secure build practices across apps and packages.

Does this security audit work when adding new dependencies to an existing JavaScript monorepo?▼

This security audit works when adding dependencies by validating lockfiles and scanning apps/ and packages/ for dependency risks. It enforces dependency isolation and flags insecure configurations during the update.

What are the limitations of scanning for high-entropy keys to enforce a zero-secrets policy?▼

Scanning for high-entropy keys to enforce a zero-secrets policy is limited to detecting statistically random strings, which may miss low-entropy hardcoded secrets. It requires proper .env ignoring and lockfile validation to comprehensively secure build practices.

Related Skills

Explore More Software Engineering Skills→
oaustegardoaustegard
137

versioning-skills

Initialize Git repositories and commit changes for skill directories.

Community
Basic
XSpoonAiXSpoonAi
17

secret-guard

Detect API keys, tokens, and private keys in git staged changes.

Official
Intermediate
kzinmrkzinmr
7

requesting-code-review

Automate pre-commit code review with static analysis, security scanning, and automated fixes.

Community
Advanced
diriendirien
19

dep-upgrade

Upgrade dependencies one at a time with test verification and git rollback.

Community
Advanced