security-auditor

Scan codebases for security vulnerabilities, dependency issues, and secret exposure.

1|Updated Dec 30, 2025

Search Tags:#security #vulnerability #owasp #dependencies #secrets #sast

Ready to run

npx skills add https://github.com/statick88/dotfiles --skill security-auditor-statick88

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-auditor
Source: https://github.com/statick88/dotfiles/tree/main/amp/.agents/skills/security-auditor
Command: npx skills add https://github.com/statick88/dotfiles --skill security-auditor-statick88

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill identifies security vulnerabilities and ensures compliance with security standards like OWASP, preventing security breaches and data leaks before they happen.

Core Features & Use Cases

Vulnerability Scanning: Detects dependency CVEs, injection flaws, and secret leaks.
OWASP Compliance: Audits code against OWASP Top 10 risks.
Use Case: Before deploying a new feature, run a security audit to catch any hardcoded API keys or critical vulnerabilities in your dependencies, ensuring a secure release.

Quick Start

Run a full security audit on the current project directory.

Frequently Asked Questions about security-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan code for security vulnerabilities before deployment?▼

Scanning code for security vulnerabilities involves detecting dependency CVEs using npm audit and pip-audit, identifying hardcoded API keys via high-entropy string analysis, and running SAST to catch injection flaws before deployment.

What is the best way to detect hardcoded secrets and API keys in my codebase?▼

Detecting hardcoded secrets is best achieved through high-entropy string analysis and pattern matching, which automatically identifies exposed API keys and sensitive credentials within your codebase to prevent data leaks.

How do I check my project dependencies for known CVEs?▼

You can check project dependencies for known CVEs by automating dependency scanning using npm audit for Node.js projects and pip-audit for Python environments, ensuring vulnerable packages are identified before release.

Does this security audit cover OWASP Top 10 compliance checks?▼

Yes, the security audit covers OWASP compliance by auditing your code against the OWASP Top 10 risks, specifically performing SAST to identify injection and XSS vulnerabilities that violate these security standards.

Can I use SAST to find injection and XSS vulnerabilities in my code?▼

Yes, you can use SAST to find injection and XSS vulnerabilities by performing static application security testing that analyzes your source code to identify exploitable flaws and ensure compliance with security standards.

Why do I need to run a security audit on a new feature release?▼

You need to run a security audit on a new feature release to catch hardcoded secrets, identify critical vulnerabilities in your dependencies, and verify OWASP compliance, preventing security breaches and data leaks before they happen.