Scan dependencies, code, CI/CD, and LLM integrations for security issues.
npx skills add https://github.com/tcytan/tecton --skill security-audit-tcytan
Please help me install this Agent Skill. Skill: security-audit Source: https://github.com/tcytan/tecton/tree/main/.claude/skills/security-audit Command: npx skills add https://github.com/tcytan/tecton --skill security-audit-tcytan
This Skill helps you proactively find security weaknesses by combining supply-chain checks, OWASP Top 10 code review, and STRIDE threat modeling into scored, structured audit outputs.
Run a comprehensive audit by asking the AI to execute the four phases sequentially and write the final scored report into .workflow/.security/.
High-intent search queries and answers about installing and using this skill.
To automate OWASP Top 10 code review and STRIDE threat modeling, this Skill scans dependencies, code, and CI/CD configuration sequentially, applying targeted pattern scans to map threats to architecture components and generate structured JSON findings.
Scanning CI/CD configuration and dependencies for supply chain security risks involves auditing dependency vulnerabilities and detecting secrets, then outputting structured JSON artifacts like supply-chain-report.json for regression monitoring and gate evaluation.
Yes, you can generate structured JSON audit reports that track security findings over time by consolidating supply-chain, OWASP, and threat-model artifacts into dated audit-report-{date}.json files stored in the .workflow/.security/ directory.
Yes, this security auditing approach detects LLM and prompt injection risks by including LLM integration checks within its supply-chain risk scanning phase, evaluating potential prompt-injection vulnerabilities alongside CI/CD workflow and secrets detection.
STRIDE threat modeling is a structured technique that maps threats to architecture components by identifying trust boundaries, categorizing spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege risks, outputting a consolidated threat-model.json artifact.
florianbuetowDetects integrity vulnerabilities in code, CI/CD configs, and dependencies.
wshaddixCompare BenchmarkDotNet results against baselines to detect performance regressions in CI pipelines.
OmarMiraScan project dependencies, code patterns, secrets, and configurations for security vulnerabilities.
concept2cureAudit infrastructure security across secrets, supply chain, CI/CD, and AI systems.
