What problem does it solve? Security issues like SQL injection, hardcoded secrets, and misconfigured cloud resources often slip into production because teams lack a structured review process. This Skill provides a repeatable security audit workflow that combines automated scanning, manual code review, and authorized penetration testing, producing severity-rated findings with concrete remediation steps. ## Core Features & Use Cases - SAST and Dependency Scanning: Run Semgrep, Bandit, GoSec, npm audit, and Trivy to detect vulnerable code patterns and outdated dependencies across JavaScript, Python, and Go projects. - Secret and Vulnerability Detection: Scan repositories with Gitleaks and TruffleHog or grep patterns to find hardcoded credentials, and review code against OWASP Top 10 patterns like XSS, IDOR, and command injection. - Infrastructure and Penetration Testing: Audit cloud configurations, Kubernetes manifests, and CI/CD pipelines, then validate findings through authorized active testing with documented rules of engagement. - Use Case: Before a release, point the Skill at your repository to run automated scans, manually review authentication and input handling, and receive a report ranking each finding by CVSS severity with fix guidance. ## Quick Start Ask the agent to perform a security audit of the current repository and produce a severity-rated findings report with remediation steps.
