skills.rest
ArieGoldkin
ArieGoldkinCOMMUNITY
Explore all skills by this author →
GitHub

security-checklist

Apply OWASP Top 10 security controls and run dependency, static, and secret scans.

10|Updated Aug 26, 2025
Search Tags:#static analysis#authorization#OWASP#security#authentication#vulnerability#compliance
One-click install
npx skills add https://github.com/ArieGoldkin/ai-agent-hub --skill security-checklist-ariegoldkin
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-checklist
Source: https://github.com/ArieGoldkin/ai-agent-hub/tree/main/skills/security-checklist
Command: npx skills add https://github.com/ArieGoldkin/ai-agent-hub --skill security-checklist-ariegoldkin

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pip-audit, semgrep, bandit, trufflehog, and includes checklists (resource) components.

What problem does it solve?

This skill helps developers and security professionals identify and mitigate common application vulnerabilities, ensuring robust security against threats like SQL injection, broken access control, and cryptographic failures. It streamlines security audits and implementation.

Core Features & Use Cases

  • OWASP Top 10 Mitigations: Provides detailed guidance and code examples for addressing each of the OWASP Top 10 vulnerabilities.
  • Automated Scanning Workflow: Teaches how to run dependency scanners (npm audit, pip-audit), static analysis (Semgrep, Bandit), and secret detection (TruffleHog).
  • Authentication & Authorization Patterns: Covers secure password hashing, session management, and JWT token best practices for robust access control.
  • Use Case: Before deploying a new API, use this skill to conduct a comprehensive security audit, including dependency scanning and static code analysis, to ensure all critical vulnerabilities are addressed.

Quick Start

Perform a security audit on my Python project. Scan for dependency vulnerabilities and common code issues, and provide a summary of critical findings.

Frequently Asked Questions about security-checklist

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit my application for OWASP Top 10 vulnerabilities?▼

OWASP Top 10 audits identify common application security risks like SQL injection and broken access control. Run dependency scanners (npm audit, pip-audit), static analysis tools (Semgrep, Bandit), and secret detection (TruffleHog) against your codebase, then review findings against OWASP mitigation guidance for your tech stack.

Can I scan Python and JavaScript projects for security vulnerabilities automatically?▼

Yes. Use pip-audit for Python dependencies, npm audit for JavaScript, Semgrep and Bandit for static code analysis, and TruffleHog for exposed secrets. These tools integrate into a comprehensive workflow to detect vulnerabilities across both tech stacks before deployment.

What's the best way to implement secure authentication and authorization patterns?▼

Secure authentication and authorization require proper password hashing, session management, and JWT token practices. This skill provides implementation patterns and code examples for robust access control, covering authentication mechanisms and authorization policies aligned with OWASP best practices.

How do I ensure compliance with GDPR, HIPAA, and SOC2 in my application?▼

Compliance requires mapping regulatory requirements to security controls. This skill covers defense-in-depth strategies, input validation, secrets management, key rotation, and monitoring practices that support GDPR, HIPAA, and SOC2 compliance across JavaScript, Python, and other stacks.

What should I check before deploying a new API to production?▼

Before deployment, conduct a comprehensive security audit: scan dependencies for vulnerabilities, run static analysis on code, verify secrets are not exposed, validate authentication and authorization controls, and confirm all OWASP Top 10 mitigations are in place for your API's tech stack.

Does this approach cover secrets detection and key management?▼

Yes. TruffleHog scans for exposed secrets in repositories. The skill includes guidance on secrets management, key rotation procedures, and secure defaults to prevent credential leakage and ensure proper lifecycle management across deployments.

Related Skills

Explore More Software Engineering Skills→
prince3626ezechiel-langprince3626ezechiel-lang

clawsec-scanner

Automate vulnerability detection in dependencies and OpenClaw hook handlers.

Community
Advanced
ovachieverovachiever
52

mdr-745-specialist

Assess MDR compliance and guide regulatory documentation for medical devices.

Community
Advanced
gztcodegztcode

requesting-code-review

Automate code review with static security scanning, quality gates, and an independent reviewer subagent.

Community
Advanced
Logos-LiberLogos-Liber
17

vulnerability-scanning

Identifies security vulnerabilities in code, dependencies, and container images.

Official
Advanced