skills.rest
a2mus
a2musCOMMUNITY
Explore all skills by this author →
GitHub

speckit-security-scan

Audit codebases for secrets, injection, CSRF/XSS, and dependency risks.

Updated Apr 7, 2026
Search Tags:#xss#injection#csrf#security-audit#secrets-detection#dependency-audit
One-click install
npx skills add https://github.com/a2mus/smart-da3m --skill speckit-security-scan
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: speckit-security-scan
Source: https://github.com/a2mus/smart-da3m/tree/main/.agents/skills/speckit-security-scan
Command: npx skills add https://github.com/a2mus/smart-da3m --skill speckit-security-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Identifies common security weaknesses in a codebase and produces actionable remediation guidance so teams can remediate secrets, injection, authentication, and dependency risks before deployment.

Core Features & Use Cases

  • Secrets & Credentials Discovery: Detects hardcoded keys, misused environment files, and leaked config values.
  • Injection & Input Safety Checks: Flags non-parameterized SQL, unsafe shell usage, and dynamic evaluation patterns.
  • XSS/CSRF and Auth Review: Reviews rendering of user input, CSRF protections for state-changing endpoints, and authentication/authorization coverage.
  • Rate Limiting & Dependency Audits: Checks for absence of rate limits, payload constraints, and known vulnerable dependencies.
  • Severity Classification & Remediation: Classifies findings as CRITICAL/HIGH/MEDIUM/LOW and recommends concrete fixes and testing steps.
  • Use Case: Run as a pre-deploy or CI gate to catch secrets, injection points, and vulnerable libraries, and to generate a prioritized remediation plan.

Quick Start

Run the speckit-security-scan on this repository and produce a prioritized list of findings with specific remediation steps.

Frequently Asked Questions about speckit-security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security audit on my codebase before deployment?▼

A comprehensive security audit detects hardcoded secrets, non-parameterized SQL injection, unsafe shell usage, and dynamic evaluation patterns. It flags these injection risks and provides severity-classified remediation guidance to ensure input safety before deployment.

What does a codebase security scan check for regarding XSS and CSRF vulnerabilities?▼

Security audits check for hardcoded keys, misused environment files, and leaked config values to discover exposed credentials. They classify these exposed secrets as CRITICAL or HIGH severity and recommend concrete fixes to remediate the leakage.

Can I use this to find vulnerable dependencies and missing rate limits in my application?▼

Security audits check for hardcoded keys, misused environment files, and leaked config values to discover exposed credentials. They classify these exposed secrets as CRITICAL or HIGH severity and recommend concrete fixes to remediate the leakage.

How does a static analysis security scan classify and report codebase findings?▼

To run a security audit on your codebase before deployment, trigger a scan on your repository to detect hardcoded secrets, injection points, and vulnerable dependencies. The scan produces a severity-classified list of findings with concrete remediation steps to fix issues preemptively.

What is the best way to detect leaked secrets and hardcoded keys in my source code?▼

A codebase security scan reviews how user input is rendered to identify XSS risks and verifies CSRF protections on state-changing endpoints. It also evaluates authentication and authorization coverage to ensure application session security.

Does a pre-deploy security review cover injection points and authentication gaps?▼

Yes, you can use this to find vulnerable dependencies and missing rate limits by applying the scan across your repository. It checks for the absence of payload constraints and rate limits while auditing dependencies for known vulnerabilities.

Related Skills

Explore More Software Engineering Skills→
hotriluanhotriluan

ck:security-scan

Detect secrets, vulnerable dependencies, and insecure code patterns in codebases.

Community
Advanced
nklischnklisch
7

security-review

Audit a codebase for vulnerabilities and generate a scored markdown report.

Community
Advanced
flatrickflatrick
1

security-review

Automate security reviews for code, cloud infrastructure, and CI/CD pipelines.

Community
Advanced
matteocervellimatteocervelli
25

security-scanner

Scan codebases for secrets, vulnerable dependencies, and insecure patterns.

Community
Advanced