skills.rest
Arete-Consortium
Arete-ConsortiumOFFICIAL
Explore all skills by this author →
GitHub

security-auditor

Runs SAST and OWASP audits with LLM-triaged findings and remediation patches.

4|2|Updated Jan 27, 2026
Search Tags:#owasp#penetration testing#security audit#vulnerability scan#sast#secret detection#semgrep
One-click install
npx skills add https://github.com/Arete-Consortium/ai-skills --skill security-auditor-arete-consortium
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-auditor
Source: https://github.com/Arete-Consortium/ai-skills/tree/main/personas/security/security-auditor
Command: npx skills add https://github.com/Arete-Consortium/ai-skills --skill security-auditor-arete-consortium

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires semgrep, bandit, gitleaks, pip-audit, trivy.

What problem does it solve? Raw SAST scanner output contains 50-90% false positives, making security audit reports unusable and eroding developer trust. This Skill combines semgrep, bandit, gitleaks, and dependency scanners with an LLM triage phase that filters false positives, calibrates severity, and drafts concrete remediation patches. ## Core Features & Use Cases - Multi-tool SAST sweep: Detects and runs semgrep, bandit, gitleaks, pip-audit, npm audit, cargo audit, and trivy, gracefully skipping unavailable tools. - OWASP Top 10 + secrets scan: Systematic grep-based checks for injection, broken access control, hardcoded credentials, and cryptographic failures. - LLM triage with diff tracking: Classifies each finding as real/false-positive/requires-runtime-test, persists results to SECURITY_FINDINGS.md, and supports --diff mode for regression tracking across runs. - Use Case: Before a penetration test, run the auditor with --patches to get a calibrated report where each real finding includes a unified-diff fix the team can review and apply directly. ## Quick Start Ask Claude to run a security audit on this repository and write the triaged findings to SECURITY_FINDINGS.md.

Frequently Asked Questions about security-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a SAST security audit on my codebase?▼

Invoke the security-auditor skill in Claude Code; it detects installed tools like semgrep, bandit, and gitleaks, runs them against your repo, triages findings with an LLM, and writes a calibrated report to SECURITY_FINDINGS.md in the repo root.

How do I reduce false positives from semgrep and bandit?▼

Use the skill's LLM triage phase, which reads surrounding code for each candidate finding and classifies it as real, false-positive, or requires-runtime-test with a confidence rating. Confirmed false positives are suppressed on subsequent --diff runs.

Can I track new security findings between audit runs?▼

Yes, run with the --diff flag. The skill compares findings against the previous SECURITY_FINDINGS.md using stable fingerprints based on file, enclosing function, and rule ID, then reports only new, regressed, and resolved findings.

Does the security audit work without semgrep installed?▼

Yes, the skill detects which SAST tools are available and skips missing ones, recording them as tool_unavailable in the report. It falls back to grep-based OWASP Top 10 and secrets scanning when SAST tools are absent.

Can I use a local model instead of Claude for finding triage?▼

Yes, the --ollama flag routes triage through an Animus HybridBackend running qwen2.5:14b at zero token cost, producing identical output format. This suits fleet-wide sweeps where per-finding Claude costs add up.

What are the limitations of static security analysis?▼

Static analysis cannot confirm all vulnerabilities; findings needing runtime validation are marked requires-runtime-test with a suggested exploit test. Infrastructure, network, and physical security are out of scope unless explicitly requested.

Related Skills

Explore More Software Engineering Skills→
ArMaTeCArMaTeC

security-reviewer

Identifies code vulnerabilities and generates severity-rated security audit reports with remediation guidance.

Community
Advanced
oleyna80oleyna80

security-verification-gate

Verifies security patches through diff review, validation commands, and ship/no-ship verdicts.

Community
Advanced
AradotsoAradotso
11

sparkfinderoven-security-compliance-skills

Scan application code for OWASP Top 10 issues and dependency CVEs.

Official
Advanced
aivos-xieaivos-xie
1

network-pentest

Scans, enumerates, and exploits vulnerabilities in a network using penetration testing tools.

Community
Advanced