What problem does it solve?
This Skill uncovers exposed credentials, dependency vulnerabilities, missing security headers, HTTPS problems, XSS/CSRF attack vectors, insecure CORS, and privacy compliance gaps in a website repository and translates technical findings into clear, actionable fixes for non-security experts.
Core Features & Use Cases
- Secrets Scanning: Detects API keys, .env leaks, hardcoded credentials, and accidental commits in Git history and recommends rotation and git hygiene.
- Dependency & CVE Checks: Identifies outdated packages and known vulnerabilities with guidance for npm audit and safe upgrades.
- Security Headers & HTTPS: Verifies CSP, HSTS, X-Frame-Options, Referrer-Policy, and mixed-content issues and supplies vercel.json header examples.
- XSS/CSRF & CORS Review: Finds unsafe DOM injection (innerHTML), missing CSRF tokens, and permissive CORS rules and prescribes fixes.
- Privacy & Compliance: Checks for a privacy policy, cookie consent, analytics disclosures, and data-deletion contact info.
- Use case: Run this audit before launch, after dependency updates, or when adding third-party integrations to prevent leaked keys, data exposure, and regulatory issues.
Quick Start
Run a security audit on this repository and return a prioritized report with severity levels and exact remediation steps.
