skills.rest
Yokhan
YokhanCOMMUNITY
Explore all skills by this author →
GitHub

security-audit

Scan dependencies, code patterns, and configurations to generate structured security audit reports.

Updated Jun 1, 2025
Search Tags:#security#vulnerability#xss#audit#cybersecurity#cve#penetration
One-click install
npx skills add https://github.com/Yokhan/yokhanFitnessDocsWebsite --skill security-audit-yokhan
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-audit
Source: https://github.com/Yokhan/yokhanFitnessDocsWebsite/tree/main/.claude/skills/security-audit
Command: npx skills add https://github.com/Yokhan/yokhanFitnessDocsWebsite --skill security-audit-yokhan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Automated security reviews reduce the time to identify vulnerabilities and misconfigurations in codebases, enabling teams to ship safer software faster.

Core Features & Use Cases

  • Dependency scanning across npm, pip, cargo, and govulncheck to surface HIGH/CRITICAL vulnerabilities.
  • Static and dynamic code pattern checks for SQL injection, XSS, command injection, path traversal, hardcoded secrets, and insecure crypto.
  • Configuration and container security checks including DEBUG flags, CORS settings, rate limiting, security headers, TLS, non-root user, and multi-stage builds.
  • Output a structured audit report with prioritized fixes and actionable remediation steps.

Quick Start

Run a full security audit on the current project to generate a structured findings report.

Frequently Asked Questions about security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate security vulnerability checks for outdated dependencies across npm and pip?▼

Automate security vulnerability checks by running dependency scans across package managers like npm, pip, cargo, and govulncheck to surface HIGH and CRITICAL level issues in your project libraries.

Can I detect XSS and SQL injection vulnerabilities in my codebase automatically?▼

Yes, you can detect XSS and SQL injection vulnerabilities automatically by running static and dynamic code pattern checks that also identify command injection, path traversal, hardcoded secrets, and insecure crypto.

How do I perform a container security audit for Docker misconfigurations and insecure defaults?▼

Perform a container security audit by reviewing configurations for insecure defaults, checking TLS settings, CORS policies, DEBUG flags, rate limiting, security headers, and verifying non-root user usage in multi-stage builds.

What is the best way to generate a structured security audit report with severity levels and remediation steps?▼

The best way to generate a structured security audit report is to execute an automated review that outputs prioritized findings with assigned severity levels and actionable recommended fixes for your codebase.

Does automated security auditing work with CI pipelines for continuous vulnerability scanning?▼

Yes, automated security auditing can integrate directly with CI pipelines to continuously identify vulnerabilities, scan dependencies, and check configurations during the software development lifecycle.

How do I check for hardcoded secrets and exposed credentials in my source code?▼

Check for hardcoded secrets and exposed credentials by running automated code pattern checks that scan your source code to surface high-risk security issues and generate a structured findings report.

Related Skills

Explore More Software Engineering Skills→
simplerick0simplerick0

sast

Scan source code for security flaws and produce markdown findings.

Community
Advanced
pkuntikpkuntik
1

issue-manager

Convert code review findings into structured GitHub Issues with labels and milestones.

Community
Advanced
BagelHoleBagelHole
46

sast-scanning

Performs static security testing on source code using Semgrep, CodeQL, and SonarQube.

Community
Intermediate
vm0-aivm0-ai
76

browserless

Execute Puppeteer and Playwright scripts in the cloud via REST endpoints.

Official
Intermediate