Agent skill · security · erichowens
security-auditor
Security vulnerability scanner and OWASP compliance auditor for codebases. Dependency scanning (npm audit, pip-audit), secret detection (high-entropy strings, API keys), SAST for injection/XSS
Why this skill is useful
Adds executable scripts for comprehensive security audits and vulnerability detection that are not commonly found in public documentation.
What it needs
Requires npm, pip installed locally. About 5k tokens when loaded. Last updated 2026-07-14. 180 stars on the source repository.
What this skill does
Security Auditor Comprehensive security scanning for codebases. Identifies vulnerabilities before they become incidents. Focuses on actionable findings with remediation guidance. When to Use Use for: Pre-deployment security audits Dependency vulnerability scanning Secret/credential leak detection Code-level SAST (Static Application Security Testing) Security posture reports for stakeholders OWASP Top 10 compliance checking Pre-PR security reviews Do NOT use for: Runtime security (WAF, rate limiting) - use infrastructure tools Network security/firewall rules - use cloud/DevOps skills SOC2/HIPAA/PCI compliance - requires legal/organizational process Penetration testing execution - this is detection, not exploitation Quick Start Full Security Audit Quick Checks Core Scanning Capabilities 1. Dependency Scanning Package Manager Command Severity Levels ----------------- --------- ----------------- npm npm audit --json critical, high, moderate, low yarn yarn audit --json same as npm pip pip-audit --format json critical, high, medium, low cargo cargo audit --json same Decision Tree: 2. Secret Detection High-Risk Patterns: API keys: /[A-Za-z0-9]{20,}/ near "key", "api", "secret" AWS credentials: AKIA[0-9A-Z]{16} Private keys: -----BEGIN (RSA EC OPENSSH) PRIVATE KEY----- JWT tokens: eyJ[A-Za-z0-9-]+\.eyJ[A-Za-z0-9-]+\.[A-Za-z0-9-]+ Connection strings: ://[^:]+:[^@]+@ Entropy Analysis: Shannon entropy > 4.5 on strings > 20 chars = suspicious Base64-encoded blobs in source = investigate False Positive Handling: 3. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills erichowens/security-auditor