security-check

Audit codebases for security vulnerabilities across languages and frameworks.

Updated May 15, 2021
One-click install
npx skills add https://github.com/JustinFirsching/dotfiles --skill security-check-justinfirsching
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: security-check
Source: https://github.com/JustinFirsching/dotfiles/tree/main/opencode/.config/opencode/skill/security-check
Command: npx skills add https://github.com/JustinFirsching/dotfiles --skill security-check-justinfirsching

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security audits and code reviews often miss subtle vulnerabilities; this Skill provides a structured, readable framework to identify security issues early and guide remediation.

Core Features & Use Cases

  • Security review questions to assess risk and potential impact
  • Catalog of common vulnerability patterns (injection, deserialization, path traversal, SSRF, etc.)
  • Secrets & credentials handling guidance to avoid leaks
  • Dependency scanning and cryptography best practices
  • Use cases: pre-commit checks, code reviews, and security assessments in CI/CD

Quick Start

Run this skill during code reviews to surface common vulnerabilities and insecure patterns.

Frequently Asked Questions about security-check

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I spot security vulnerabilities during a code review?

Identify security vulnerabilities during code review by applying a structured framework that audits codebases for insecure patterns, injection flaws, and insecure deserialization. This approach surfaces issues early to guide remediation before deployment.

What is the best way to check for insecure secrets and cryptography handling in my codebase?

Checking for insecure secrets and cryptography handling involves auditing configurations and patterns to ensure credentials are not leaked. A structured security assessment validates that best practices for dependency scanning and secrets management are followed.

Can I run a security audit across different programming languages and frameworks?

Yes, you can run a security audit across different programming languages and frameworks. This approach applies to security assessments and pull requests universally, focusing on common vulnerability patterns rather than language-specific syntax.

How do I assess injection and SSRF risks before merging a pull request?

Assess injection and SSRF risks before merging a pull request by running pre-commit checks against a catalog of common vulnerability patterns. This surfaces potential security issues early in the CI/CD pipeline to guide immediate remediation.

Does dependency scanning help identify vulnerabilities in codebases?

Dependency scanning helps identify vulnerabilities in codebases by checking external libraries against known security flaws. Combined with cryptography best practices, it provides a structured framework to address risks early during security assessments.