skills.rest
karenrebecag
karenrebecagCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

security-audit

Audits an entire codebase for vulnerabilities and generates a prioritized security report.

Updated Sep 17, 2026
Search Tags:#owasp#security audit#vulnerability scan#sast#secret detection#ci/cd security#dependency scanning
One-click install
npx skills add https://github.com/karenrebecag/spec-driven-standards --skill security-audit-karenrebecag
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-audit
Source: https://github.com/karenrebecag/spec-driven-standards/tree/main/plugins/security/skills/security-audit
Command: npx skills add https://github.com/karenrebecag/spec-driven-standards --skill security-audit-karenrebecag

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Manually reviewing a whole project for security issues is slow and easy to get wrong. This Skill runs a structured, read-only audit of an entire codebase and produces a prioritized report covering dependencies, code patterns, secrets, configuration, and CI/CD risks. ## Core Features & Use Cases - Five parallel analysis phases: dependency vulnerability scanning (SCA), code security analysis (SAST), secret detection, configuration and infrastructure review, and supply chain/CI/CD checks. - Standards-based classification: every finding is mapped to CWE Top 25 and OWASP 2025 Top 10, scored by severity, and consolidated into a risk score. - Prioritized report: saves a full report with evidence and remediation code to ~/Desktop/security-audit-{project}-{date}.md. - Use Case: Before delivering a client project, point the Skill at the repository to catch leaked secrets, unpinned dependencies, missing auth middleware, and GitHub Actions script injection in one pass. ## Quick Start Ask the assistant to run a security audit on the project at a given path, for example: audit the security of the project at ~/projects/my-app.

Frequently Asked Questions about security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security audit on an entire project?▼

Provide the path to the project directory and the audit runs reconnaissance, then five parallel analysis phases covering dependencies, code patterns, secrets, configuration, and CI/CD. It finishes by writing a prioritized report to your Desktop.

What tools does a security audit use for dependency scanning?▼

It uses trivy, npm audit, pip-audit, or cargo-audit when available on the machine. If none are installed, it reports which tool to install and continues with the other analysis phases.

Does the security audit modify my project files?▼

No. The audit is strictly read-only: it never edits, installs, or executes anything in the target project. Its only write operation is saving the report file to the Desktop.

Can the audit detect leaked secrets and API keys?▼

Yes. A dedicated phase runs a bundled secret scanner plus gitleaks if available, checks .gitignore coverage for .env and key files, and reports findings with values redacted so secrets never appear in the report.

What are the limitations of the security audit on large projects?▼

Projects over 10,000 files use a critical-path scan focused on API routes, auth, configuration, and CI workflows. The report states the coverage percentage and recommends external tools like Semgrep or Trivy for deeper analysis.

When should I use security-audit instead of a code review?▼

Use it for whole-project assessments that produce a written report. For reviewing code just written or a single diff, a code review agent is the right scope; this Skill is for full-codebase audits.

Related Skills

Explore More Software Engineering Skills→
Serg28Serg28

security-reviewer

Automate security audits with semgrep, trivy, gitleaks, and dependency scanners.

Community
Intermediate
wubing7755wubing7755

ada-code-quality-report-verification

Verifies code quality report claims against actual source code and reproducible tool output.

Community
Advanced
UnitOneAIUnitOneAI
44

cve-triage

Prioritize CVEs into SLA tiers using CVSS 4.0, SSVC 2.1, EPSS, and CISA KEV.

Official
Intermediate
danchamorrodanchamorro
13

code-review

Review code changes and pull request diffs for bugs, security vulnerabilities, and quality issues.

Community
Advanced