skills.rest
commercetools
commercetoolsOFFICIAL
Explore all skills by this author →
WebsiteGitHub

security-auditor

Audit code repositories for vulnerabilities and generate remediation reports.

154|28|Updated Aug 31, 2018
Search Tags:#code-review#security-audit#application-security#vulnerability-assessment#repo-scanning#poc-generation
One-click install
npx skills add https://github.com/commercetools/ui-kit --skill security-auditor-commercetools
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-auditor
Source: https://github.com/commercetools/ui-kit/tree/main/.agents/skills/security-auditor
Command: npx skills add https://github.com/commercetools/ui-kit --skill security-auditor-commercetools

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill automates an in-depth security review of a code repository to find web and API vulnerabilities, highlight sensitive exposures, and produce actionable proof-of-concepts and remediation guidance so teams can prioritize and fix critical risks before deployment.

Core Features & Use Cases

  • Full-repository scanning: Analyze source code, configuration, CI/CD pipelines, Docker and Kubernetes manifests, and infrastructure templates for common and advanced security issues.
  • Vulnerability discovery with context: Detect injection flaws, authentication/authorization issues, XSS/CSRF, insecure configurations, exposed secrets, SSRF/XXE, deserialization problems, and logic vulnerabilities with file locations and severity.
  • Proof-of-Concept generation: Produce reproducible exploitation steps, payload examples, and remediation patches to accelerate triage and fixes.
  • Report generation: Compile a structured markdown report summarizing findings, statistics, remediation recommendations, and compliance mapping for stakeholders and auditors.

Quick Start

Run the security-auditor against the repository root to generate a complete markdown audit report with prioritized findings and PoCs.

Frequently Asked Questions about security-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a security audit on source code and Docker manifests before deployment?▼

To conduct a comprehensive security audit, the Skill analyzes source code, configuration files, Docker and CI/CD manifests, detecting injection, authentication flaws, and misconfigurations to generate a structured markdown report with prioritized findings.

What is the best way to generate proof-of-concept exploits for detected API vulnerabilities?▼

Generating proof-of-concept exploits for API vulnerabilities involves producing reproducible exploitation steps, payload examples, and remediation patches, which this Skill provides alongside severity ratings and file locations to accelerate triage and fixes.

Can I scan Kubernetes infrastructure templates for sensitive data exposure and misconfigurations?▼

Yes, you can scan Kubernetes infrastructure templates and configuration files for sensitive data exposure, insecure configurations, and exposed secrets to identify critical security risks during pre-deployment or code review.

How does automated repo scanning detect SSRF, XXE, and deserialization vulnerabilities?▼

Automated repo scanning detects SSRF, XXE, and deserialization vulnerabilities by applying in-depth analysis to source code and infrastructure templates, reporting discovered issues with file locations and severity ratings for stakeholders.

Does this security audit tool work without external dependencies or components?▼

Yes, this security audit tool operates without external dependencies or components, allowing you to run it directly against the repository root to analyze web and API applications and generate a complete markdown audit report.

What is included in a vulnerability assessment report for stakeholders and auditors?▼

A vulnerability assessment report includes a structured markdown summary of findings, statistics, step-by-step proof-of-concepts, remediation guidance, and compliance mapping designed for stakeholders and auditors.

Related Skills

Explore More Software Engineering Skills→
Veloxia-agencyVeloxia-agency

env-secrets-manager

Audit environment files and source code for exposed secrets.

Community
Advanced
jokken79jokken79
1

File Path Traversal Testing

Detect and validate file path traversal vulnerabilities in web applications.

Community
Advanced
LuisSambranoLuisSambrano
7

code-review

Perform systematic code review and static analysis across multiple programming languages.

Community
Advanced
NickCrewNickCrew
29

owasp-top-10

Identify OWASP Top 10 security vulnerabilities in web applications.

Community
Advanced