skills.rest
ils15
ils15COMMUNITY
Explore all skills by this author →
GitHub

security-audit-pro

Audit codebases for vulnerabilities, dependencies, container security, SBOM, PII, and compliance.

10|5|Updated Dec 12, 2025
Search Tags:#compliance#container security#SAST#SCA#SBOM#security-audit#PII detection
One-click install
npx skills add https://github.com/ils15/pantheon --skill security-audit-pro
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-audit-pro
Source: https://github.com/ils15/pantheon/tree/main/platform/windsurf/.windsurf/skills/security-audit-pro
Command: npx skills add https://github.com/ils15/pantheon --skill security-audit-pro

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pip-audit, safety, npm, audit-ci, cyclonedx-bom, cyclonedx-npm, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill addresses the challenge of ensuring the security of code repositories by conducting a comprehensive audit that includes Static Application Security Testing (SAST), Software Composition Analysis (SCA), container security, Software Bill of Materials (SBOM), Personal Identifiable Information (PII) detection, and compliance with standards like GDPR, LGPD, and HIPAA.

Core Features & Use Cases

  • Comprehensive Security Review: Checks for SQL injection, XSS, CSRF, path traversal, command injection, and more.
  • Software Composition Analysis: Identifies dependencies with known CVEs and outdated packages.
  • Container Security: Validates Dockerfile configurations for non-root users, health checks, secrets, minimal base images, and more.
  • SBOM Generation: Generates SBOM for compliance tracking.
  • PII Detection: Scans for personal data in code and logs.
  • Compliance Checking: Ensures GDPR, LGPD, HIPAA compliance patterns are met.
  • Integration with Themis: Applied during code review for thorough security checks.

Quick Start

Run the security-audit-pro skill to audit the 'project-codebase' directory.

Frequently Asked Questions about security-audit-pro

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I conduct a comprehensive security audit on my codebase for vulnerabilities and compliance?▼

A comprehensive security audit checks for vulnerabilities like SQL injection and XSS, scans dependencies for known CVEs, validates Dockerfile configurations, generates an SBOM, detects PII, and ensures GDPR, LGPD, and HIPAA compliance.

How does Software Composition Analysis identify vulnerable dependencies in a project?▼

Software Composition Analysis identifies vulnerable dependencies by checking project packages against known CVE databases and flagging outdated libraries using tools like pip-audit, safety, and npm audit-ci.

What is the best way to generate an SBOM and detect PII during a code review?▼

Generating an SBOM and detecting PII during code review involves scanning the project directory to catalog software components using cyclonedx and identifying personal identifiable information hidden in code and logs.

Does this security audit check Dockerfile configurations for container security?▼

Yes, container security validation checks Dockerfile configurations to ensure the use of non-root users, health checks, secure secrets handling, and minimal base images to harden the deployment environment.

Can I use static application security testing to validate GDPR and HIPAA compliance patterns?▼

Yes, static application security testing validates GDPR, LGPD, and HIPAA compliance by scanning codebases to ensure data protection regulatory patterns are met and detecting unauthorized personal identifiable information.

What types of code vulnerabilities are detected during a static code analysis security audit?▼

Static code analysis security audits detect common vulnerabilities including SQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF), path traversal, and command injection flaws.

Related Skills

Explore More Software Engineering Skills→
zm2231zm2231

dependency-manager

Identify and remediate outdated, vulnerable, or conflicting software dependencies.

Community
Advanced
weirdgmeweirdgme
4

devsecops

Automate security integration across CI/CD pipelines with policy-as-code enforcement.

Community
Advanced
guccangguccang
3

requesting-code-review

Automate pre-commit code review for security issues, regressions, and quality problems.

Community
Advanced
devendrapratapsinghdevendrapratapsingh
1

platform-security

Audit container images, Kubernetes configurations, cloud environments, and infrastructure as code for security vulnerabilities.

Community
Advanced