skills.rest
HyuseCS
HyuseCSCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

vc-security

Audits code for STRIDE and OWASP vulnerabilities with optional iterative auto-fix.

Updated Apr 9, 2026
Search Tags:#owasp#security audit#auto-fix#stride#secret detection#dependency audit#vulnerability scanning
One-click install
npx skills add https://github.com/HyuseCS/project-c --skill vc-security-hyusecs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vc-security
Source: https://github.com/HyuseCS/project-c/tree/main/.claude/skills/vc-security
Command: npx skills add https://github.com/HyuseCS/project-c --skill vc-security-hyusecs

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Security reviews are often skipped or done inconsistently before releases, leaving vulnerabilities like SQL injection, hardcoded secrets, and broken access control undetected until they become incidents. ## Core Features & Use Cases - Structured Security Audit: Runs a systematic STRIDE threat analysis plus OWASP Top 10 mapping across a scoped set of files, producing a severity-ranked findings report. - Secret and Dependency Scanning: Detects hardcoded API keys, tokens, and private keys via regex patterns, and runs stack-appropriate dependency audits (pnpm audit, pip-audit, govulncheck, cargo audit). - Iterative Auto-Fix Mode: With the --fix flag, applies one targeted fix per finding, verifies with a test/lint guard, commits each fix, and stops on regression. - Use Case: Before a release, run a full audit on your API layer to catch injection flaws and missing rate limits, then auto-remediate Critical and High findings with bounded iterations. ## Quick Start Ask the AI to run a security audit on your source directory, for example: audit src/api for security vulnerabilities and fix the critical findings with at most 10 iterations.

Frequently Asked Questions about vc-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security audit on my codebase?▼

Invoke the audit with a scope glob such as src/api/**/*.ts or the keyword full for the entire codebase. It scans all in-scope files, applies STRIDE and OWASP checks, detects secrets, and outputs a severity-ranked findings report.

How to automatically fix security vulnerabilities found in an audit?▼

Add the --fix flag to apply fixes iteratively, sorted by severity from Critical to Low. Each fix is verified with a test or lint guard and committed separately; use --iterations N to cap the number of fix attempts.

What dependency audit tools does it support for different stacks?▼

It runs pnpm audit for Node.js, pip-audit for Python, govulncheck for Go, bundle audit for Ruby, mvn dependency-check for Java/Maven, and cargo audit for Rust, selecting the tool based on the detected stack.

How does secret detection avoid false positives?▼

Secret scanning uses high-confidence regex patterns for formats like AWS keys, GitHub tokens, and Stripe keys, and skips matches in test, example, and markdown files as well as placeholder values like YOUR_KEY_HERE or environment variable references.

When should I not run a security audit?▼

Skip the audit for purely cosmetic changes such as CSS or copy edits where no user-facing code or data handling is involved. It is designed for releases, auth or payment features, and periodic compliance reviews.

Related Skills

Explore More Software Engineering Skills→
KeyValueSoftwareSystemsKeyValueSoftwareSystems
3

detect-stack

Identifies technology stacks by scanning manifests and source files, then installs matching Maestro skills and IDE configurations.

Official
Intermediate
lync-cyberlync-cyber
133

sprint-review

Evaluate sprint delivery completeness and acceptance-criteria coverage against planned work.

Community
Advanced
selfagencyselfagency

security-review

Analyze codebases for security vulnerabilities and generate patch proposals.

Community
Advanced
rfdiosuaorfdiosuao
30

security-audit

Audit application code for OWASP Top 10 vulnerabilities and CVE impacts.

Community
Advanced