security-audit

Audit code for security vulnerabilities and generate a structured security report.

39|2|Updated Jan 31, 2026

Search Tags:#OWASP #security #audit #code-review #report #CI

Ready to run

npx skills add https://github.com/hffmnnj/opencode-goopspec --skill security-audit-hffmnnj

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-audit
Source: https://github.com/hffmnnj/opencode-goopspec/tree/main/skills/security-audit
Command: npx skills add https://github.com/hffmnnj/opencode-goopspec --skill security-audit-hffmnnj

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps developers and security teams identify and remediate security vulnerabilities in codebases before deployment, reducing risk and rework.

Core Features & Use Cases

Code Review: Evaluate authentication/authorization logic, input validation, data handling, cryptographic usage, and error handling.
Configuration & Infrastructure: Assess security headers, CORS, environment variables, dependencies; API, database, and network security.
Audit Delivery: Generate an actionable security audit report with risk ratings and remediation guidance.
Use Case: Before releasing a web service, run a security audit to surface critical issues in a pull request.

Quick Start

Install and run the tool to start a baseline audit:

Command: security-audit --path . --output audit.md

Frequently Asked Questions about security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I identify security vulnerabilities in my code before deployment?▼

Code security audits systematically review authentication, input validation, cryptographic usage, and error handling to surface vulnerabilities. This Skill audits codebases across web apps, services, and libraries, enforcing OWASP Top 10 coverage and generating a structured report with risk ratings and remediation guidance for CI workflows.

Can I run security checks on configuration and infrastructure in my codebase?▼

Yes. This Skill assesses security headers, CORS settings, environment variables, dependencies, and API, database, and network security configurations alongside code review, providing a comprehensive audit that covers both application and infrastructure security.

What does a security audit report include?▼

The audit report delivers actionable findings with risk ratings, remediation guidance, and dependency health checks. It's structured for developers and security teams to prioritize fixes and integrates into pull request workflows for pre-deployment review.

How do I integrate security audits into my CI workflow?▼

Run the audit tool as a CI step using `security-audit --path . --output audit.md` to generate baseline reports. The structured output integrates into pull requests, allowing teams to surface and remediate vulnerabilities before release.

Does this cover dependency security and OWASP vulnerabilities?▼

Yes. The Skill enforces OWASP Top 10 coverage, includes dependency health checks to identify compromised or outdated packages, and applies secure defaults across code review, configuration, and infrastructure assessments.