Scan Python and Shell scripts for security vulnerabilities and risky patterns.
npx skills add https://github.com/wulaosiji/skills --skill skill-security-audit
Please help me install this Agent Skill. Skill: skill-security-audit Source: https://github.com/wulaosiji/skills/tree/main/skill-security-audit Command: npx skills add https://github.com/wulaosiji/skills --skill skill-security-audit
This Skill addresses the critical need to identify and mitigate security vulnerabilities within AI skills, ensuring the safety and integrity of automated workflows.
eval(), exec(), os.system(), and subprocess calls with shell=True..ssh/, .aws/, .env).Run the security audit on the skill located at /path/to/skill.
High-intent search queries and answers about installing and using this skill.
To scan Python and Shell scripts for security vulnerabilities, run this audit tool on your target skill directory. It identifies dangerous patterns like arbitrary code execution, command injection, and insecure file operations, then generates a summary report with detailed findings.
When assessing risky patterns before deployment, look for dangerous code like eval(), exec(), os.system(), and subprocess calls with shell=True. You should also check for hardcoded API keys, passwords, and access to sensitive directories like .ssh/ or .aws/.
Yes, you can detect hardcoded API keys and sensitive data exposure in shell scripts. The audit flags potential tokens and passwords, alongside identifying insecure access to sensitive directories such as .ssh/, .aws/, and .env files.
Security risk assessment categorizes code scanning findings into critical, high, medium, and low-risk levels. This classification covers identified vulnerabilities including arbitrary code execution, command injection, sensitive data exposure, and insecure file operations.
No dependencies are required to run a security audit on a skill directory. The tool operates independently using its built-in scripts to scan your specified path and generate a comprehensive risk assessment report.
sendaifunBridge assets and messages between Solana and EVM chains using the deBridge Solana SDK.
ApegurusClassify smart contract vulnerability severity using an impact-versus-likelihood rubric.
WellFitCommunityScan codebases for HIPAA compliance violations involving PHI.
mahmoud20138Monitor live portfolio exposure and drawdown with threshold-based alerts and kill switches.