skills.rest
Miosa-osa
Miosa-osaOFFICIAL
Explore all skills by this author →
WebsiteGitHub

security-auditor

Identify and remediate security vulnerabilities across codebases and configurations.

226|55|Updated Mar 19, 2026
Search Tags:#security#vulnerability#owasp#audit#sast#secret-detection#sca
One-click install
npx skills add https://github.com/Miosa-osa/canopy --skill security-auditor-miosa-osa
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-auditor
Source: https://github.com/Miosa-osa/canopy/tree/main/library/skills/security/auditor
Command: npx skills add https://github.com/Miosa-osa/canopy --skill security-auditor-miosa-osa

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill analyzes codebases and configurations to identify security vulnerabilities, misconfigurations, and compliance gaps, enabling proactive remediation.

Core Features & Use Cases

  • Reconnaissance and Static Analysis (SAST) across languages to find vulnerabilities
  • Dependency Analysis (SCA) to detect vulnerable or outdated libraries
  • Secret Detection to uncover exposed credentials and sensitive data
  • Configuration Review and OWASP Top 10 mapping for secure defaults
  • Structured Reporting to produce actionable findings for teams

Quick Start

Provide your codebase path or repository URL to start a security audit and receive a structured findings report.

Frequently Asked Questions about security-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security audit on my codebase to find vulnerabilities?▼

Run a security audit by providing a codebase path or repository URL to trigger static analysis, dependency checks, and secret scanning. This generates a structured findings report mapping issues to the OWASP Top 10 for proactive remediation.

What is SAST and SCA scanning for software vulnerability detection?▼

SAST and SCA scanning analyze source code and dependencies to detect security vulnerabilities. SAST uses tools like Semgrep and Bandit for code analysis, while SCA uses Trivy and npm audit to identify outdated or vulnerable libraries.

Can I detect exposed API keys and secrets inside my Git repositories?▼

Yes, you can detect exposed credentials and sensitive data using secret detection tools like Gitleaks and TruffleHog. These scan your repositories and containers to uncover exposed secrets for immediate remediation.

Does this security audit tool support multi-language projects and CI pipelines?▼

Yes, this security audit is applicable to multi-language projects and CI pipelines. It performs static analysis across various languages and audits configurations to ensure secure defaults during continuous integration.

What is the best way to map codebase vulnerabilities to the OWASP Top 10?▼

The best way to map vulnerabilities to the OWASP Top 10 is through a structured security audit. This process analyzes codebases and configurations, producing actionable reports that align findings with standard OWASP categories.

Why does secret detection fail to find credentials in my Docker containers?▼

Secret detection requires scanning the correct paths within your repositories and containers. Ensure your configuration review includes tools like TruffleHog and Gitleaks, and verify that container filesystems are accessible during the audit.

Related Skills

Explore More Software Engineering Skills→
slbugslbug
7

rb:secrets

Detect leaked secrets and exposed credentials in Ruby codebases.

Community
Intermediate
webrix-aiwebrix-ai
1

vulnerability-prioritization

Correlate CVE scan results with infrastructure to prioritize patching and create Jira tickets.

Official
Advanced
allanninalallanninal
1

semgrep

Scan codebases for security vulnerabilities and coding standards with Semgrep.

Community
Intermediate
jassicsjassics
6

mobile-pentest

Automate MASTG-based mobile penetration tests on Android and iOS apps.

Community
Advanced