skills.rest
yuquanliu1-dot
yuquanliu1-dotCOMMUNITY
Explore all skills by this author →
GitHub

skill-security-auditor

Scan project directories for vulnerabilities, secrets, and insecure configurations.

Updated Aug 27, 2026
Search Tags:#owasp#security-audit#secret-detection#vulnerability-scan#config-hardening#cve-readiness
One-click install
npx skills add https://github.com/yuquanliu1-dot/Test --skill skill-security-auditor-yuquanliu1-dot
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: skill-security-auditor
Source: https://github.com/yuquanliu1-dot/Test/tree/main/.claude/skills/skill-security-auditor
Command: npx skills add https://github.com/yuquanliu1-dot/Test --skill skill-security-auditor-yuquanliu1-dot

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Security auditing helps you catch common weaknesses early—like hardcoded secrets, injection risks, insecure configurations, and dependency issues—so you can reduce the chance of breaches after deployment.

Core Features & Use Cases

  • Secrets detection: Scans a project for hardcoded credentials and tokens (for example AWS keys, GitHub/GitLab tokens, Slack/Stripe keys, private key blocks).
  • Security pattern scanning: Flags risky code patterns such as dangerous function calls (eval/exec, command execution patterns, unsafe YAML loading) and insecure configuration settings (e.g., DEBUG enabled, permissive CORS, TLS verification disabled).
  • Guided auditing workflow: Provides an OWASP-focused checklist and a report structure to help turn findings into actionable remediation steps, including next-step references for deeper patterns.

Quick Start

Ask the AI to run a security scan of your codebase by executing python scripts/scan_project.py /path/to/project.

Frequently Asked Questions about skill-security-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan my codebase for hardcoded secrets and security vulnerabilities?▼

To scan for security vulnerabilities and hardcoded secrets, run a deterministic pattern-based file scanner across your source files to detect embedded credentials, injection risks, and insecure configurations, then output findings in text or JSON format for triage.

What types of hardcoded credentials can a code repository security audit detect?▼

A code repository security audit detects hardcoded credentials such as AWS keys, GitHub and GitLab tokens, Slack and Stripe keys, and private key blocks by scanning source files for specific secret patterns before deployment.

How does pattern-based vulnerability scanning find risky code patterns like command injection?▼

Pattern-based vulnerability scanning identifies risky code by flagging dangerous function calls like eval and exec, command execution patterns, unsafe YAML loading, and insecure configuration settings such as permissive CORS or disabled TLS verification.

Can I integrate a security audit into my triage workflow for OWASP compliance?▼

Yes, you can integrate security auditing into your triage workflow by using an OWASP-focused checklist and a structured report to turn scan findings into actionable remediation steps, including next-step references for deeper pattern analysis.

Does the security scanner require external dependencies to scan source files?▼

No, the security scanner requires no external dependencies to operate, using internal scripts to perform deterministic pattern-based scanning across source files to identify misconfigurations, secrets, and common vulnerabilities.

What output formats are supported when scanning a project for misconfigurations and vulnerabilities?▼

When scanning a project for misconfigurations and vulnerabilities, the security audit supports outputting findings in either text or JSON format, allowing you to summarize results effectively for triage and remediation tracking.

Related Skills

Explore More Software Engineering Skills→
julianjabjulianjab

security-audit

Scan codebases for hardcoded secrets and security vulnerabilities.

Community
Intermediate
GaryOcean428GaryOcean428

security-audit

Detect secrets, insecure dependencies, and vulnerable patterns in codebases.

Community
Advanced
armanzeroeightarmanzeroeight
29

vulnerability-scanner

Scan codebases for security vulnerabilities and identify CVE patterns.

Community
Intermediate
kivo360kivo360
1

moai-domain-security

Mitigate security vulnerabilities in CI/CD pipelines using OWASP Top 10 and SAST/DAST workflows.

Community
Advanced