Agent skill · security · aaaaqwq
security-audit
Audit codebases, infrastructure, AND agentic AI systems for security issues. Covers traditional security (dependencies, secrets, OWASP web top 10, SSL/TLS, file permissions) PLUS agentic security (prompt injection scanning, identity spoofing detection, memory poisoning checks, multi-agent communication audit, OWASP Agentic Top 10). Use when scanning for vulnerabilities, detecting hardcoded secrets, reviewing agent workspace configuration, checking prompt injection vectors, or auditing agent permissions and boundaries.
Why this skill is useful
Adds executable scripts for vulnerability scanning and secret detection that enhance the AI's security auditing capabilities.
What it needs
Requires curl, git, npm, openssl, pip installed locally. About 10k tokens when loaded. Last updated 2026-08-06. 83 stars on the source repository.
What this skill does
Security Audit Scan, detect, and fix security issues in codebases and infrastructure. Covers dependency vulnerabilities, secret detection, OWASP top 10, SSL/TLS verification, file permissions, and secure coding patterns. When to Use Scanning project dependencies for known vulnerabilities Detecting hardcoded secrets, API keys, or credentials in source code Reviewing code for OWASP top 10 vulnerabilities (injection, XSS, CSRF, etc.) Verifying SSL/TLS configuration for endpoints Auditing file and directory permissions Checking authentication and authorization patterns Preparing for a security review or compliance audit Dependency Vulnerability Scanning Node.js Python Go Rust Universal: Trivy (scans any project) Secret Detection Manual grep patterns Automated scanning with git Pre-commit hook for secrets .gitignore audit OWASP Top 10 Code Patterns 1. Injection (SQL, Command, LDAP) 2. Broken Authentication 3. Cross-Site Scripting (XSS) 4. Insecure Direct Object References 5. Security Misconfiguration SSL/TLS Verification Check endpoint SSL Verify certificate chain Check SSL from code File Permission Audit Full Project Security Audit Script Secure Coding Quick Reference Environment variables instead of hardcoded secrets Input validation checklist HTTP security headers Tips Run npm audit / pip-audit / govulncheck in CI on every pull request, not just occasionally. Secret detection in git history matters: even if a secret is removed from HEAD, it exists in git history. Use git filter-branch or git-filter-repo to purge, then rotate the credential. The most dangerous vulnerabilities are often the simplest: SQL injection via string concatenation, command injection via unsanitized input, XSS via innerHTML. CORS Access-Control-Allow-Origin: is safe for truly public, read-only APIs. It's dangerous for anything that uses cookies or auth tokens. Always verify SSL in production. verify=False or rejectUnauthorized: false should only appear in test code, never in production paths. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aaaaqwq/agentic-security-audit