security-audit

To run a security audit, target your project directory to execute installed scanners like bandit, semgrep, and eslint. The skill aggregates findings across Python and JavaScript files, returning a structured report with severity counts and remediation priorities.

Static analysis examines source code without executing it to find security issues and vulnerabilities. Secrets detection specifically scans configuration and code files for hardcoded credentials using tools like gitleaks to prevent accidental exposure.

Yes, you can check dependencies for known vulnerabilities using pip-audit for Python projects. The dependency audit cross-references installed packages against vulnerability databases to surface outdated or compromised libraries in your codebase.

A read-only security scan enforces non-destructive checks and does not modify or delete any project files. It only reads the target path to analyze code and returns structured findings without altering your codebase.

The best way to prioritize vulnerabilities is by severity counts provided in the structured output. The scan aggregates findings and generates a remediation-focused summary, allowing you to address critical security issues before lower severity ones.

Supported scanners for SAST and secrets detection include bandit, semgrep, ruff, eslint, and gitleaks. These tools run against your target path to perform static analysis, linting, and hardcoded credential checks across Python and JavaScript projects.