security

Audit JavaScript/TypeScript repositories for secrets and OWASP Top 10 vulnerabilities.

7|1|Updated Feb 14, 2026

Search Tags:#vulnerabilities #ci-cd #security-audit #secrets-detection #dependency-check #gitleaks #owasp-top-10

Ready to run

npx skills add https://github.com/tartinerlabs/skills --skill security-tartinerlabs

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security
Source: https://github.com/tartinerlabs/skills/tree/main/skills/security
Command: npx skills add https://github.com/tartinerlabs/skills --skill security-tartinerlabs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Auditing software projects for security vulnerabilities, sensitive data exposure, and insecure dependencies by combining OWASP Top 10 checks with GitLeaks.

Core Features & Use Cases

Rule-driven security checks for OWASP Top 10, hardcoded secrets, authentication flaws, insecure dependencies, and data protection.
Pre-commit and CI workflow integrations to enforce secure coding practices and generate structured remediation reports.
Suitable for JavaScript/TypeScript projects and multi-repo governance, enabling repeated audits across CI pipelines and PR reviews.

Quick Start

Run the security audit workflow on your project to identify secrets, vulnerabilities, and insecure dependencies.

Frequently Asked Questions about security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan my JavaScript code for hardcoded secrets and OWASP Top 10 vulnerabilities?▼

Scanning JavaScript code for hardcoded secrets and OWASP Top 10 vulnerabilities involves integrating GitLeaks and rule-driven checks into your repository. This process identifies insecure dependencies and secret exposure, generating a structured remediation report.

Can I automate security audits in my CI pipeline using GitLeaks?▼

Yes, you can automate security audits in your CI pipeline using GitLeaks. By integrating pre-commit hooks and CI workflow checks, the audit enforces secure coding practices across JavaScript and TypeScript projects during PR reviews.

What is the best way to detect sensitive data exposure in a TypeScript project repository?▼

Detecting sensitive data exposure in a TypeScript repository is best achieved through automated secret detection and dependency checks. Running a security audit scans configurations and code for hardcoded secrets, outputting a structured remediation report.

Do I need GitLeaks installed to run a repository security audit?▼

Yes, GitLeaks is a required dependency for running this repository security audit. You also need pre-commit hook setup and specific rule files under the rules/ directory to properly execute the OWASP Top 10 and secret detection checks.

Does this security audit work with multi-repo governance for CI pipelines?▼

Yes, this security audit supports multi-repo governance for CI pipelines. It enables repeated security audits across multiple repositories by integrating seamlessly into CI workflows and pull request reviews to enforce secure coding practices.

What limitations exist when auditing insecure dependencies with rule files?▼

Auditing insecure dependencies with rule files requires proper configuration under the rules/ directory. The audit is currently applicable to JavaScript and TypeScript projects, and relies on GitLeaks and pre-commit hooks to function correctly.