security-auditor

Scan codebases for vulnerabilities, secret leaks, and misconfigurations.

13|2|Updated Mar 17, 2026

Search Tags:#security #owasp #dependencies #audit #secrets #vulnerabilities #code-review

Ready to run

npx skills add https://github.com/amanning3390/hermeshub --skill security-auditor-amanning3390

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-auditor
Source: https://github.com/amanning3390/hermeshub/tree/main/skills/security-auditor
Command: npx skills add https://github.com/amanning3390/hermeshub --skill security-auditor-amanning3390

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Scan code for vulnerabilities, secret leaks, dependency issues, and configuration problems. Use when the user wants a security audit, vulnerability scan, or code security review.

Core Features & Use Cases

Secret Scanning: Detect exposed API keys, tokens, and credentials in repository history.
Dependency Audit: Evaluate dependencies for known vulnerabilities and outdated components.
Code Analysis: Aligns with OWASP Top 10 and security misconfiguration checks.
Hermes Skill Security Scan: Pre-install review to ensure no data exfiltration or prompt injection patterns.
Report Format: Generates a structured Security Audit Report with risks and remediation steps.

Quick Start

Run a comprehensive security audit on the target codebase and generate a structured report.

Frequently Asked Questions about security-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan code for vulnerabilities and exposed secrets before deployment?▼

You can run an end-to-end security audit to detect secret leaks, evaluate dependency vulnerabilities, and align findings with OWASP Top 10 risk categorization, generating a structured report with remediation steps.

What is OWASP-aligned code analysis for security misconfigurations?▼

OWASP-aligned code analysis is a security review mechanism that identifies misconfigurations and vulnerabilities within your codebase by mapping identified risks to the OWASP Top 10 categories for structured remediation.

How do I audit dependencies for known vulnerabilities across different ecosystems?▼

You audit dependencies by running a dependency audit that evaluates third-party components across languages and ecosystems for known vulnerabilities and outdated libraries, including the findings in a structured security report.

Does this security audit work for third-party component assessments and pre-deployment scans?▼

Yes, the security audit applies to pre-deployment scans and third-party component assessments across languages and ecosystems, performing checks for secret scanning, dependency auditing, and misconfigurations.

Can I detect exposed API keys and tokens in my repository history?▼

Yes, secret scanning detects exposed API keys, tokens, and credentials hidden within your repository history, ensuring that leaked authentication data is identified and flagged for remediation.

What is the best way to generate a structured security audit report with remediation steps?▼

The best way to generate a structured security audit report is to execute an end-to-end vulnerability scan that categorizes identified risks and outputs actionable remediation steps for each detected issue.