What problem does it solve? Agents and developers often claim "security is fine" without actually checking. This Skill replaces self-attestation with a runnable security gate that scans a project for real vulnerabilities — hardcoded secrets, disabled TLS verification, committed .env files, unverified payment webhooks, and high/critical npm audit findings — and exits non-zero on genuine failures so it can block commits and CI pipelines. ## Core Features & Use Cases - Secret and misconfiguration detection: Finds private keys, AWS/GitHub/Slack/Stripe/Google/Anthropic/OpenAI tokens, generic secret assignments, disabled TLS verification, and git-tracked .env files. - File-level absence rules: Flags webhook endpoints that read request bodies without signature verification (FAIL) and file upload handlers with no visible type or size check (WARN). - Dependency auditing with exceptions: Runs npm audit at a configurable level, reports root advisories instead of inherited noise, and supports per-advisory, expiring exceptions via security-exceptions.json. - Warning ratchet: Budgets warning counts per scan scope so warning piles can only shrink, never silently grow; over-budget findings fail the push. - Use Case: Before committing a new Stripe webhook endpoint, run the gate to confirm the handler verifies signatures, no secrets leaked into source, and npm audit is clean — the commit is blocked automatically if any check fails. ## Quick Start Run the security gate on my project directory and fail the build if it finds hardcoded secrets, unverified webhooks, or high-severity npm audit advisories.
