skills.rest
drewid74
drewid74COMMUNITY
Explore all skills by this author →
GitHub

security-engineer

Audit code, dependencies, and deployments for exploitable vulnerabilities and credential leaks.

8|1|Updated Mar 30, 2026
Search Tags:#security audit#supply chain security#vulnerability remediation#secrets rotation#web app hardening#dependency CVE
One-click install
npx skills add https://github.com/drewid74/ai_skills --skill security-engineer-drewid74
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-engineer
Source: https://github.com/drewid74/ai_skills/tree/main/security-engineer
Command: npx skills add https://github.com/drewid74/ai_skills --skill security-engineer-drewid74

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps identify and fix security vulnerabilities in code, infrastructure, and supply-chain workflows before they become breaches or compliance failures.

Core Features & Use Cases

  • Application vulnerability detection: Finds exploitable flaws such as SQL injection, command injection, XSS, CSRF, SSRF, IDOR, and broken authentication by enforcing concrete decision rules.
  • Operational security hardening: Covers secrets leakage, credential rotation, container privilege issues (e.g., running as root), missing auth checks, and TLS/session cookie safety.
  • Dependency and supply-chain risk control: Blocks deploys for unmitigated HIGH/CRITICAL CVEs, ensures deterministic builds via pinned versions/digests, and encourages SBOM + signing/attestation.
  • Quality gates for readiness: Provides checklist-style gates for secrets scanning, parameterized queries, security headers, MFA enforcement, and incident response sequencing.

Quick Start

Ask the AI to run a security audit of your application and deployment for injection flaws, hardcoded secrets, missing authentication/authorization checks, and unpatched HIGH/CRITICAL vulnerabilities.

Frequently Asked Questions about security-engineer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit my web application for security vulnerabilities like SQL injection and XSS?▼

To audit web application security for injection flaws like SQLi, XSS, CSRF, and SSRF, you can enforce concrete decision rules that detect exploitable vulnerabilities and credential leaks in your code before deployment. The process checks parameterization, escaping, and allowlisting to prevent these attacks.

What is the best way to block deploys for unpatched HIGH and CRITICAL dependency CVEs?▼

Blocking deploys for unpatched HIGH/CRITICAL dependency CVEs requires triaging dependencies and enforcing quality gates. This approach ensures deterministic builds via pinned versions and digests, while encouraging SBOM generation and artifact signing to control supply-chain risk.

How do I harden infrastructure security for TLS, session cookies, and containers?▼

Hardening infrastructure security for TLS, session cookies, and containers involves checking for non-root container policies, validating missing auth checks, and ensuring credential rotation. This operational hardening prevents privilege issues and secrets leakage across your deployments.

Can I use this to generate an SBOM and enforce supply chain security controls?▼

Yes, you can enforce supply-chain security controls by generating an SBOM and ensuring artifact signing and attestation. This secures your workflows by pinning versions and digests for deterministic builds, preventing compliance failures before they occur.

What quality gates do I need for readiness checks like secrets scanning and MFA enforcement?▼

Readiness quality gates for secrets scanning and MFA enforcement require checklist-style validation for parameterized queries, security headers, and incident response sequencing. These gates ensure your application meets baseline security requirements before release.

Related Skills

Explore More Software Engineering Skills→
darblexdarblex

Vulnerability Scanner

Detect and prioritize security vulnerabilities in source code repositories.

Community
Advanced
harnessharness
80

enforce-sbom

Insert SBOM Policy Enforcement steps into existing Harness pipelines.

Official
Advanced
kivo360kivo360
1

moai-domain-security

Mitigate security vulnerabilities in CI/CD pipelines using OWASP Top 10 and SAST/DAST workflows.

Community
Advanced
SkobynSkobyn

hunt-sqli

Detect and exploit SQL injection vulnerabilities in web applications.

Community
Advanced