skills.rest
dhanesh
dhaneshCOMMUNITY
Explore all skills by this author →
Website𝕏@dhaneshpurohitGitHub

security-posture-audit

Audit repository security hygiene with deterministic offline checks and severity-graded findings.

1|Updated May 28, 2026
Search Tags:#github actions#security audit#dependency pinning#credential detection#ci security#posture report#offline scanner
One-click install
npx skills add https://github.com/dhanesh/agent-skills --skill security-posture-audit-dhanesh
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-posture-audit
Source: https://github.com/dhanesh/agent-skills/tree/main/security-posture-audit
Command: npx skills add https://github.com/dhanesh/agent-skills --skill security-posture-audit-dhanesh

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes assets (resource) and references (resource) components.

What problem does it solve? Repositories accumulate security hygiene defects — unpinned dependencies, committed .env or .pem files, hardcoded debug flags, wildcard CORS, risky GitHub Actions patterns — that are tedious to grep for by hand and easy to misjudge without context. This Skill runs a deterministic, read-only, fully offline scanner over the tree and then adjudicates each finding in context, producing a severity-graded posture report with file:line evidence and concrete remediations. ## Core Features & Use Cases - Deterministic posture scanning: A stdlib-only Python script detects unpinned Python/Node/Docker dependencies, credential-shaped files (.env, *.pem, id_rsa), debug and permissive-CORS flags, plain-http transports, pull_request_target plus head-checkout workflows, curl|sh in CI, world-writable/setuid modes, and a missing SECURITY.md. - In-context adjudication: The agent opens each flagged file and adjusts draft severities against a documented rubric, so a debug flag in a test fixture becomes INFO while the same line in a production entrypoint stays HIGH. - Verifiable remediation: After fixes are applied, the scan is re-run to confirm each finding is gone, with before/after counts quoted in the report. - Use Case: Before open-sourcing an internal repo, ask the agent to audit its security posture; receive a report grouping HIGH/MEDIUM/LOW/INFO findings with evidence, adjudication notes, fixes, and an explicit list of what the audit does not cover (CVEs, SAST, secret values). ## Quick Start Ask the agent to audit this repository's security posture and report severity-graded findings with remediations.

Frequently Asked Questions about security-posture-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a repository's security posture offline?▼

Run the bundled scanner with python3 assets/audit_posture.py /path/to/repo, optionally adding --format json or --fail-on medium. It walks the tree read-only, skips .git and node_modules, and emits severity-graded findings with file:line evidence and remediations.

What security issues does a posture hygiene check detect?▼

It detects unpinned Python, Node, and Docker dependencies, committed .env/.pem/id_rsa files, hardcoded debug flags, wildcard CORS origins, plain-http config URLs, pip trusted-host, pull_request_target with PR-head checkout, curl piped to shell in workflows, world-writable or setuid files, and a missing SECURITY.md.

Is this a CVE scanner or secrets scanner?▼

No. It has no advisory database and no network access, so it cannot match dependency versions to known CVEs, and it flags credential-shaped files by name only without reading contents. Pair it with a dedicated secrets scanner and a CVE tool for those layers.

Does the security audit work on Windows repositories?▼

Yes, but the world-writable and setuid file-mode checks are POSIX-only and are skipped on Windows trees. All content-based checks — dependencies, credential filenames, debug flags, CORS, transports, and workflows — still run normally.

Why does the audit report a false positive on my package.json?▼

The dep-unpinned-node check uses a same-directory lockfile heuristic, so monorepo workspaces with a root lockfile can be flagged incorrectly. The adjudication step verifies the workspace-root lockfile and downgrades the finding to INFO with the stated reason.

How do I gate CI on security posture findings?▼

Run the scanner with --fail-on set to high, medium, low, or info; it exits 1 when any finding meets the threshold and 0 otherwise. Use --fail-on never to always exit 0 while still collecting the full JSON findings list.

Related Skills

Explore More Software Engineering Skills→
LaravelDailyLaravelDaily
132

laraveldaily-permissions-audit

Audit Laravel PHP source files for authorization and permission issues.

Community
Intermediate
Trigent-Software-Pvt-LtdTrigent-Software-Pvt-Ltd

secrets

Detect exposed secrets, credentials, and API keys in code and git history.

Official
Advanced
CbowcrptexCbowcrptex

Vuln Scanner

Audit trending GitHub repositories for security vulnerabilities and disclose findings via PVR or dependency PRs.

Community
Advanced
staruhubstaruhub
706

security-audit

Scan code, dependencies, and server configurations for vulnerabilities and leaked secrets.

Community
Advanced