Agent skill · security · aaaaqwq
security-audit
Audit codebases and infrastructure for security issues. Use when scanning dependencies for vulnerabilities, detecting hardcoded secrets, checking OWASP top 10 issues, verifying SSL/TLS, auditing file permissions, or reviewing code for injection and auth flaws.
Why this skill is useful
Adds multiple executable scripts for vulnerability scanning and secret detection that extend the AI's capabilities in security auditing.
What it needs
Requires curl, git, npm, openssl, pip installed locally. About 8k tokens when loaded. Last updated 2026-08-06. 83 stars on the source repository.
What this skill does
Security Audit Scan, detect, and fix security issues in codebases and infrastructure. Covers dependency vulnerabilities, secret detection, OWASP top 10, SSL/TLS verification, file permissions, and secure coding patterns. When to Use Scanning project dependencies for known vulnerabilities Detecting hardcoded secrets, API keys, or credentials in source code Reviewing code for OWASP top 10 vulnerabilities (injection, XSS, CSRF, etc.) Verifying SSL/TLS configuration for endpoints Auditing file and directory permissions Checking authentication and authorization patterns Preparing for a security review or compliance audit Dependency Vulnerability Scanning Node.js Python Go Rust Universal: Trivy (scans any project) Secret Detection Manual grep patterns Automated scanning with git Pre-commit hook for secrets .gitignore audit OWASP Top 10 Code Patterns 1. Injection (SQL, Command, LDAP) 2. Broken Authentication 3. Cross-Site Scripting (XSS) 4. Insecure Direct Object References 5. Security Misconfiguration SSL/TLS Verification Check endpoint SSL Verify certificate chain Check SSL from code File Permission Audit Full Project Security Audit Script Secure Coding Quick Reference Environment variables instead of hardcoded secrets Input validation checklist HTTP security headers Tips Run npm audit / pip-audit / govulncheck in CI on every pull request, not just occasionally. Secret detection in git history matters: even if a secret is removed from HEAD, it exists in git history. Use git filter-branch or git-filter-repo to purge, then rotate the credential. The most dangerous vulnerabilities are often the simplest: SQL injection via string concatenation, command injection via unsanitized input, XSS via innerHTML. CORS Access-Control-Allow-Origin: is safe for truly public, read-only APIs. It's dangerous for anything that uses cookies or auth tokens. Always verify SSL in production. verify=False or rejectUnauthorized: false should only appear in test code, never in production paths. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aaaaqwq/security-audit-toolkit