skills.rest
ruskicoder
ruskicoderCOMMUNITY
Explore all skills by this author →
GitHub

security-audit-codebase

Audits codebases for exposed secrets, vulnerable dependencies, injection flaws, and OWASP Top 10 issues.

3|Updated Jun 29, 2026
Search Tags:#code review#owasp#compliance#security audit#secret scanning#injection detection#dependency vulnerabilities
One-click install
npx skills add https://github.com/ruskicoder/system-prompts --skill security-audit-codebase-ruskicoder
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-audit-codebase
Source: https://github.com/ruskicoder/system-prompts/tree/main/prompt-orchestrator/.opencode/skills/security-audit-codebase
Command: npx skills add https://github.com/ruskicoder/system-prompts --skill security-audit-codebase-ruskicoder

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Shipping code with leaked API keys, outdated vulnerable dependencies, or injection flaws can lead to breaches and failed compliance audits. This Skill provides a systematic, step-by-step security review of any codebase before release or open-sourcing. ## Core Features & Use Cases - Secret & Credential Scanning: Uses regex patterns and tools like gitleaks and trufflehog to detect API keys, private keys, passwords, and database connection strings in code and git history. - Dependency Vulnerability Audits: Runs npm audit, pip-audit, cargo audit, and govulncheck to surface known CVEs in third-party packages. - Injection & OWASP Top 10 Checks: Detects SQL injection, command injection, XSS, path traversal, broken access control (BOLA/IDOR), weak cryptography, and misconfigured security headers. - Use Case: Before open-sourcing a private repository, run the audit to confirm no secrets are committed, dependencies are patched, and authentication checks are enforced, then receive a severity-ranked remediation report. ## Quick Start Ask the AI to run a security audit on your repository covering secrets, dependencies, and injection vulnerabilities, and produce a severity-ranked remediation report.

Frequently Asked Questions about security-audit-codebase

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a codebase for exposed API keys and secrets?▼

Use regex searches for token patterns like sk-, ghp_, AKIA, and AIza, or run dedicated scanners such as gitleaks and trufflehog. Also check git ls-files for tracked .env, .pem, or credentials files and rotate any active secrets found.

How to audit dependencies for known vulnerabilities?▼

Run the package manager's built-in auditor: npm audit for Node.js, pip-audit or safety for Python, cargo audit for Rust, and govulncheck for Go. Apply fixes with npm audit fix or by upgrading and pinning patched versions.

What tools detect SQL injection and XSS in source code?▼

Grep for string interpolation inside SQL queries, unsanitized shell calls like exec or subprocess with shell=True, and raw HTML sinks such as dangerouslySetInnerHTML and innerHTML. SAST tools like semgrep and bandit automate these checks.

Can this audit help with SOC 2 or ISO 27001 compliance?▼

Yes, the audit accepts an optional compliance framework focus such as OWASP Top 10, SOC 2, or ISO 27001 and maps findings into a severity-ranked report. It covers access control, cryptography, and security header checks relevant to those standards.

What should I do if secrets are found in git history?▼

Immediately revoke and rotate the compromised credential, then remove the file from tracking with git rm --cached and add it to .gitignore. Sanitize history using git-filter-repo, since deleting the file in a new commit leaves it recoverable.

Related Skills

Explore More Software Engineering Skills→
ourchitectureourchitecture
1

privacy-scan

Detect secrets, PII, and analytics drift with Gitleaks and Semgrep scans.

Official
Advanced
zapabobzapabob
2

sec-audit

Scan dependencies and custom code for security vulnerabilities.

Community
Advanced
haJ1thaJ1t

auto-changelog

Generate CHANGELOG.md from git commit history using Conventional Commits.

Community
Advanced
MonumentalSystemsMonumentalSystems
17

vulnerability-scanning

Scan application code, dependencies, and container images for security vulnerabilities.

Official
Advanced