skills.rest
larsboes
larsboesCOMMUNITY
Explore all skills by this author →
GitHub

security-audit

Scan repositories, packages, or extensions for security risks before installation.

Updated Aug 27, 2026
Search Tags:#security#audit#risk-assessment#code-review#env-vars#dependency-audit#malware-detection
One-click install
npx skills add https://github.com/larsboes/pai-marketplace --skill security-audit-larsboes
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-audit
Source: https://github.com/larsboes/pai-marketplace/tree/main/marketplace/plugins/devtools/skills/security-audit
Command: npx skills add https://github.com/larsboes/pai-marketplace --skill security-audit-larsboes

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This skill helps teams evaluate repositories, packages, or extensions before installation by providing a structured security audit that detects potential threats and data leakage.

Core Features & Use Cases

  • Automated static checks for suspicious endpoints, leaked credentials, and risky code patterns.
  • Dependency and environment risk assessment across common ecosystems.
  • Use Case: Before integrating a new npm package or library, run the audit to surface potential risks and get actionable remediation steps.

Quick Start

Run the auditor on a local repository to generate a risk report before installation.

Frequently Asked Questions about security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a security audit on a repository before installing it?▼

A security audit detects potential threats and data leakage by scanning for suspicious endpoints, leaked credentials, and risky code patterns across code, configuration, and dependencies before you integrate a new package or extension.

Can I detect leaked environment variables and credentials in third-party code?▼

Yes, the audit includes automated static checks specifically designed to detect environment variable exposure and leaked credentials across code and configuration files before installation.

How do I check npm dependencies for malware and risky code patterns?▼

Run the auditor on the package to perform a dependency audit that scans for risky code patterns, suspicious endpoints, and malware indicators across common ecosystems, providing actionable remediation steps.

Does this static code review tool categorize security risks with evidence?▼

Yes, the static code review categorizes security risks through guided checks and provides clear evidence for suspicious endpoints, leaked credentials, and dangerous calls found during the audit.

What is the best way to assess extension risks before integration?▼

Run a structured security audit to assess extension risks by performing automated static checks for suspicious endpoints, leaked credentials, and dangerous calls, surfacing potential threats before integration.

Related Skills

Explore More Software Engineering Skills→
devrelaicomdevrelaicom
37

midnight-verify:verify-by-ledger-source

Verify ledger claims by tracing them to Rust source files and paths.

Official
Advanced
anorthamanortham
3

detect-hardcoded-secrets

Detect hardcoded secrets and credentials across source code languages.

Community
Advanced
00PrabalK0000PrabalK00
1

secrets-config-sanitizer

Detect hard-coded secrets and configuration leakage in code and deployment files.

Community
Advanced
balsm-healthbalsm-health
2

analyzing-android-malware-with-apktool

Analyze Android APK files for malware indicators using apktool, jadx, and androguard.

Official
Advanced