What problem does it solve? Security checks are often skipped or done inconsistently: developers forget to verify commit signing, miss CVEs in non-Python dependency trees, suppress vulnerabilities incorrectly, or expose services with a port binding but no authentication. This Skill provides a repeatable audit workflow covering environment validation, vulnerability scanning, dependency auditing, and secrets detection. ## Core Features & Use Cases - Environment Validation: Verify GPG secret keys, SSH agent keys, Git commit signing configuration, and user identity before committing signed work. - Vulnerability Scanning: Run bandit, semgrep, and ruff security rules against source code, plus pip-audit for Python dependencies, with correct CVE suppression via the --ignore-vuln CLI flag. - Multi-Ecosystem Dependency Audit: Enumerate every package ecosystem (pip, npm, cargo, go) and run each ecosystem's audit tool so Dependabot alerts are triaged against the right tree. - Secrets Encryption & Detection: Encrypt .env files with GPG AES256 and detect leaked secrets with gitleaks and trufflehog. - Use Case: Before a release, run a full audit to confirm signing keys work, no known CVEs remain in any dependency ecosystem, no secrets are committed, and every exposed port has both scoped binding and authentication. ## Quick Start Ask the AI to run a full security audit of this repository covering environment validation, dependency scanning, and secrets detection.
